News

Researchers Say Gazelle Browser Offers Better Security

A team consisting of Microsoft Research personnel and university staff members has demonstrated a potentially more secure Web browser called Gazelle. A paper (PDF) describing the browser prototype was published at Microsoft Research on Thursday.

However this research team, led by Helen J. Wang and others, appears to be doing work that's separate from Microsoft's Internet Explorer 8 team. IE8 and Google Chrome frequently appear in the paper as examples of browsers that get security wrong.

The team claims that the Gazelle browser, which ran on Windows Vista and uses Internet Explorer's Trident renderer, offers greater security by using a browser-based operating system called a "browser kernel." The browser kernel consists of approximately 5,000 lines of C# code and is "resilient to memory attacks," according to the authors. Not even IE8 offers the same protection, they contend.

"No existing browsers, including new architectures like IE 8, Google Chrome, and OP [another experimental browser], have a multi-principal OS construction that gives a browser-based OS, typically called Browser Kernel, the exclusive control to manage the protection and fair-sharing of all system resources among browser principals," the authors write.

The Gazelle browser enables Web sites (or "principals") to communicate with each other, but they do so by passing messages through the browser kernel, just as would be done via interprocess communications. The browser kernel manages security as well as the sharing of system resources.

In contrast to Google Chrome, Gazelle runs a Web page and its embedded principals in separate processes. The authors also claim that Gazelle handles tabbed browsing in a superior way to IE8.

"IE 8 uses OS processes to isolate tabs from one another. This granularity is insufficient since a user may browse multiple mutually distrusting sites in a single tab and a web page may contain an iframe with content from an untrusted site (e.g., ads)," the authors explain.

Gazelle separates same-origin domains, such as ad.datacenter.com and user.datacenter.com, whereas Google Chrome considers them from the same site. The browser kernel even manages address bars and menus in the browser, plus it controls whether or not browser plug-ins can interoperate with the operating system.

The overlay of transparent content, which can trick users into clicking on content from another origin, is thwarted by a policy that makes dynamic content-containing windows opaque.

Gazelle still has leaps and bounds to travel to get beyond its prototype stage. In many instances, Gazelle is slower than IE7 due to greater overhead, although it does start up faster than IE7.

Gazelle also may choke on the browser plug-in issue. The authors explain that "existing plugin software must be adapted (ported or binary-rewritten) to use Browser Kernel system calls to accomplish its tasks."

The authors did test Gazelle successfully on 19 of 20 Alexa-reported popular Web sites, calling the browser's performance "acceptable." Some of the overhead problems caused by "IE instrumentation" can be eliminated, the authors say.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.

Featured

  • Microsoft Appoints Althoff as New CEO for Commercial Business

    Microsoft CEO and chairman Satya Nadella on Wednesday announced the promotion of Judson Althoff to CEO of the company's commercial business, presenting the move as a response to the dramatic industrywide shifts caused by AI.

  • Broadcom Revamps VMware Partner Program Again

    Broadcom recently announced a significant update regarding its VMware Cloud Service Provider (VCSP) program, coinciding with the release of VMware Cloud Foundation (VCF) 9.0, a key component in Broadcom’s private cloud strategy.

  • Closeup of the new Copilot keyboard key

    Microsoft Updates Copilot To Add Context-Sensitive Agents to Teams, SharePoint

    Microsoft has rolled out a new public preview for collaborative "always on" agents in Microsoft 365 Copilot, bringing enhanced, context-aware tools into Teams channels, meetings, SharePoint sites, Planner workstreams and Viva Engage communities.

  • Windows 365 Cloud Apps Now Available for Public Preview

    Microsoft announced this week that Windows 365 Cloud Apps are now available for public preview. This aims to allow IT administrators to stream individual Windows applications from the cloud, removing the need to assign Cloud PCs to every user.