Features
Google Chrome aims to be secure, fast, simple and stable. There are extensive differences from its peers in Chrome's minimalistic user interface, which is atypical of modern web browsers. For example, Chrome does not render RSS feeds. One of Chrome's strengths is its application performance and JavaScript processing speed, both of which were independently verified by multiple websites to be the swiftest among the major browsers of its time. Many of Chrome's unique features had been previously announced by other browser developers, but Google was the first to implement and publicly release them. For example, a prominent graphical user interface (GUI) innovation, the merging of the address bar and search bar (the Omnibox), was first announced by Mozilla in May 2008 as a planned feature for Firefox. Both Internet Explorer 9 and Safari (version 6) have since merged the search and address bar.
Bookmarks and settings synchronisation
Chrome allows users to synchronize their bookmarks, history, and settings across all devices with the browser installed by sending and receiving data through a chosen Google Account, which in turn updates all signed-in instances of Chrome.
Web standards support
The first release of Google Chrome passed both the Acid1 and Acid2 tests. Beginning with version 4.0, Chrome has passed all aspects of the Acid3test.
Chrome currently has very good support for JavaScript/ECMAScript according to Ecma International's ECMAScript standards conformance Test 262 (version ES5.1 of 2012-05-18). This test reports as the final score the number of tests a browser failed; hence lower scores are better. In this test, Chrome version 28.0.1500.95 scored 10 failed/11573 passed. For comparison, Firefox 19 scored 193 failed/11752 passed and Internet Explorer 9 has a score of 600+ failed, while Internet Explorer 10 has a score of 7 failed.
On the official CSS 2.1 test suite by standardization organization W3C, WebKit, the Chrome rendering engine, passes 89.75% (89.38% out of 99.59% covered) CSS 2.1 tests.
On the HTML5 test, Chrome 31 on desktop scores 503 out of 555 points, which makes it the first place among desktop browsers. Chrome 31 for Android holds the first place among tablet browsers and the second place among mobile browsers, with 482 points.
Security
Chrome periodically retrieves updates of two blacklists (one for phishing and one for malware), and warns users when they attempt to visit a harmful site. This service is also made available for use by others via a free public API called "Google Safe Browsing API".
Chrome uses a complex process-allocation model to allocate different tabs to fit into different processes to prevent what happens in one tab from affecting what happens in others. Following the principle of least privilege, each process is stripped of its rights and can compute, but cannot interact with sensitive areas (e.g. OS memory, user files) — this is similar to the "Protected Mode" used by Internet Explorer 9 and 10. The Sandbox Team is said to have "taken this existing process boundary and made it into a jail." This enforces a computer security model whereby there are two levels of multilevel security (user and sandbox) and the sandbox can only respond to communication requests initiated by the user. On Linux sandboxing uses the seccomp mode.
In December 2011 a report by Accuvant, funded by Google, rated the sandbox security of Google Chrome 12 and 13 as better than either Internet Explorer 9 or Mozilla Firefox 5.
Since 2008 Chrome has been faulted for not including a master password to prevent casual access to a user's passwords. Chrome developers have indicated that a master password does not provide real security against determined hackers and have refused to implement one. Bugs filed on this issue have been marked "WontFix".
Security vulnerabilities
No security vulnerabilities in Chrome had been successfully exploited in the three years of Pwn2Own from 2009–2011.
However, Chrome was defeated at Pwn2Own 2012, by a French team who used zero day exploits in the version of Flash shipped with Chrome to take complete control of a fully patched 64-bit Windows 7 PC using a booby-trapped website that overcame Chrome's sandboxing.
Chrome was also compromised twice at the 2012 CanSecWest Pwnium. Google's official response to the exploits was delivered by Jason Kersey, who congratulated the researchers, noting "We also believe that both submissions are works of art and deserve wider sharing and recognition." Fixes for these vulnerabilities were deployed within 10 hours of the submission.
Version 23 fixed 15 security vulnerabilities of which six were rated as high priority.
Malware blocking
Google introduced download scanning protection in Chrome 17.
Plugins
- Chrome supports plug-ins with the Netscape Plugin Application Programming Interface (NPAPI), so that plug-ins (for example Adobe Flash Player) run as an unrestricted separate process outside the browser and cannot be sandboxed as tabs are. ActiveX is not supported. On March 30, 2010 Google announced that the latest development version of Chrome would bundle Adobe Flash with the browser, eliminating the need to download and install it separately. Flash would be kept up to date as part of Chrome's own updates. Java applet support is available in Chrome with Java 6 update 12 and above. Support for Java under OS X was provided by a Java Update released on May 18, 2010.
- On August 12, 2009, Google introduced a replacement for NPAPI that is more portable and more secure called Pepper Plugin API (PPAPI). The default bundled PPAPI Flash Player (or Pepper-based Flash Player) was available on Chrome OS first, then replaced the NPAPI Flash Player on Linux from Chrome version 20, on Windows from version 21 (which also reduced Flash crashes by 20%), and eventually came to OS X at version 23.
Privacy mode
The private browsing feature called Incognito mode prevents the browser from permanently storing any history information or cookies from the websites visited. Incognito mode is similar to the private browsing feature in other web browsers. Chrome was the second browser to implement this feature, after Safari.
