At this point, if you’ve visited our website at all in the last few months, we shouldn’t have to convince you to download the latest updates for all of your apps and devices when they drop. Zero-day vulnerabilities are discovered nearly on a daily basis, and one of the best ways to ensure that your private data stays private is to get the updates right away. To that point, we hope that every Chrome user has already updated their browser to version 90, but if you’re holding out for some reason (or just forgot), Google shared yet another reason to update this week.
Alex Gough, an engineer on the Chrome platform security team, revealed in a blog post on Tuesday that Chrome 90 for Windows devices adopts Hardware-enforced Stack Protection, which Microsoft announced back in March. This mitigation technology makes it more difficult for hackers to exploit security bugs, and is supported by any computers with the Windows 20H1 December update or later installed, running on processors with Control-flow Enforcement Technology (CET), which includes Intel Core 11th Gen and AMD Zen 3 CPUs.
“With this mitigation, the processor maintains a new, protected, stack of valid return addresses (a shadow stack),” Gough explains. “This improves security by making exploits more difficult to write. However, it may affect stability if software that loads itself into Chrome is not compatible with the mitigation.”
If you want to know all the nitty-gritty details about this new technology, be sure to read the full blog post, but in effect, Hardware- enforced Stack Protection is a response to a new attack method called Return Oriented Programming (ROP), which attackers invented after Microsoft introduced Data Execution Prevention.
Here’s how stack protection combats ROP, according to Gough:
Along with the existing stack, the cpu maintains a shadow stack. This stack cannot be directly manipulated by normal program code and only stores return addresses. The CALL instruction is modified to push a return address (the instruction after the CALL) to both the normal stack, and the shadow stack. The RET (return) instruction still takes its return address from the normal stack, but now verifies that it is the same as the one stored in the shadow stack region. If it is, then the program is left alone and it continues to work as it always did. If the addresses do not match then an exception is raised which is intercepted by the operating system (not by Chrome). The operating system has an opportunity to modify the shadow region and allow the program to continue, but in most cases an address mismatch is the result of a program error so the program is immediately terminated.
There are limitations to this technology, but all you need to know is that it will keep you safer from malicious attacks. If you aren’t sure whether or not you’ve updated to the latest version of Chrome on your Windows 10 computer, you can find out by going to Settings > About Chrome and checking if you’re up to date.
