Google’s Chrome Security Decision

The Surprise Google Chrome Web Store Decision

The recent Chrome browser 2FA bypass attacks involved dozens of extensions being hacked and replaced with malicious versions that had the potential to impact millions of users. Call it a sophisticated phishing attack if you like, as social engineering was used to gain access to the various developer credentials required to make the extension switch, but one thing’s for sure: this was a security game-changer.

At the time, Google’s Chrome security team said that less than 1% of extension installs from the Chrome Web Store were found to include malware and "before an extension is even accessible to install from the Chrome Web Store, we have two levels of verification to ensure an extension is safe." Now, Google has taken a further step to help ensure this kind of attack doesn’t happen again.

The Curated Chrome Web Store Experience

Designed to provide businesses with a greater degree of control, as well as improved visibility, of their extension ecosystem, the new Chrome Web Store offers enhanced extension management capabilities. Google divides these capabilities into five categories:

• Simplified access to allow users to more efficiently find and install pre-approved extensions directly from the Chrome Web Store landing page.
• Enhanced security to promote these trusted extensions while minimizing the risk from potentially harmful ones being installed.
• Increased productivity as users will only be able to use the specific, pre-approved, extensions they need in their roles.
• Customizable interface to give admins greater control over the Web Store experience, including the curation of extension collections along with category-based controls.
• Greater transparency through enabling admins to create custom block messages on Chrome extension detail pages for more visibility into usage policies, coming "early this year" according to Google.

Conclusion

The new Chrome Web Store for enterprise users is a significant step forward in ensuring the security and integrity of the Chrome extension ecosystem. By providing businesses with a greater degree of control and visibility, Google is helping to mitigate the risk of 2FA bypass attacks and other security threats. While the new store is currently only available to enterprise users, it’s likely that its features will be rolled out to all users in the future.

FAQs

Q: What is the new Chrome Web Store?
A: The new Chrome Web Store is a curated experience designed to provide businesses with a greater degree of control and visibility over their Chrome extension ecosystem.

Q: What features does the new Chrome Web Store offer?
A: The new Chrome Web Store offers simplified access, enhanced security, increased productivity, customizable interface, and greater transparency.

Q: Is the new Chrome Web Store only available to enterprise users?
A: Yes, the new Chrome Web Store is currently only available to enterprise users, but it’s likely that its features will be rolled out to all users in the future.

Q: When is the new Chrome Web Store expected to be available to all users?
A: The new Chrome Web Store is expected to be available to all users "early this year" according to Google.