Instead, he referred to an official statement that said the graphics engine comes with an extension 'specifically designed to prevent denial of service and out-of-range memory access attacks from WebGL content.' The spokesman didn't say if these measures are enough to prevent the Webgl vulnerabilities described by Context from being exploited in Chrome.Ī spokesman for the Khronos Group, which maintains the WebGL standard, similarly didn't address the Context report directly in an email to The Register. This is a key intermediate step to help protect Chrome users. I'd also point out that Chrome doesn't run on some system configurations if lower level stack issues are identified. To help ward off lower level attacks, we work with hardware, OS, and driver vendors to proactively disable unsafe system configurations and help them improve the robustness of their stack. A Google spokesman didn't address the claims in the Context report head on, but did offer the following: Many parts of the WebGL stack, including the GPU process, run in separate processes and are sandboxed in Chrome to help prevent various kinds of attacks.
