Everything, Everything

Google's installation of Chrome has made UAC completely redundant. The (very much) beta browser installs itself into the user's AppData folder on Vista. For example:

C:\Users\Robert\AppData\Local\Google\Chrome\Application\

This explains why users had their browsers updated silently without them realising. At first I figured maybe they were running with Administrator privileges on XP or Vista with UAC disabled (so they deserve everything they get), but then I read about this:

Install Google Chrome: Update version
Google Chrome automatically updates to a newer version when one is released. The update process happens silently, whether or not you're using the browser at the time. If Google Chrome is open at the time of the update, you must close the browser and restart for the new version to launch.

These silent updates are done without user interaction, and with no way to turn it off! EVIL!!

There's a GoogleUpdate.exe process that runs as the logged on user, thanks to a registry setting:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run

For example:

Google Update
"C:\Users\Robert\AppData\Local\Google\Update\GoogleUpdate.exe" /c

I haven't checked, but I presume killing that process might not be enough as the application might check for updates by itself, or possibly start the GoogleUpdate process.

Because Google's Chrome is installed in the AppData folder on Vista, this means:

• multiple installations of Chrome (one per user)
• any commands you run as a standard user can affect your copy of Chrome

At least any changes made to somewhere like "C:\Program Files\Google" would have required Admin privileges, and - combined with lower privilege accounts or UAC - stopped any remote code execution vulnerabilities from affecting any user's copy of Chrome, rather than everyone else's. I really hope more developers don't write their application installations like this.

Talking of Chrome, I'm slightly appalled that Google didn't do a proper fix for the carpetbombing flaw (more annoyed that they hadn't spotted the problem themselves, even though they know the version numbers of WebKit). It's also a shame they don't prompt users by default when files are downloaded (it's a checkbox on their Minor Tweaks tab). It's obvious that a load of old browser vulnerabilities haven't been tested (long filenames, dodgy URLs) before they released their beta.

I've also noticed that their default setting for mixed content on secure pages is "Allow all content to be loaded" - rather than prompt the user or not display the insecure content. They also allow all cookies by default, rather than restricting third party. I suppose allowing all cookies would benefit Google.