Google's launch of Chrome Apps, a new breed of browser-based software that will run on top of any operating system, has left skeptical security experts wondering whether Google is creating a needless opening for cybercriminals.
Launched late last week, Chrome Apps is Google's latest step toward embedding its many services in the operating systems of rivals Microsoft and Apple. The goal is make apps running on Google's platform appear to run natively on either Windows or Mac OS X, respectively.
Even though Chrome Apps require Google's Chrome Web browser, the software can run outside the browser and offline. Documents, photos and video can be saved on a computer's hard drive, as well as Google's cloud storage service, called Google Drive. Updates, including security patches, occur automatically.
Initially, Chrome Apps will run only on Windows and the Google Chromebook, a high-end laptop powered by Google's Chrome OS. In the near future, Chrome Apps will also run on Mac OS X and Linux.
The strategy behind Chrome Apps is to merge the technology with the host OS, so users do not notice a difference. This all-in-one approach toward the user experience increases the likelihood people will use Google services, which means the company can gather more data to sell to advertisers.
"We want Chrome Apps to be so good you don't even realize it's something different," Rahul Roy-Chowdhury, project manager for Chrome Apps, told The Verge.
While the goal makes good business sense, security experts worry that Google is creating a layer of complexity that will introduce a new set of vulnerabilities that cybercriminals can exploit. Much of the concern is based on the huge security headache caused by other cross-platform technologies for running applications, such as Adobe Flash and Java, which was developed by Sun Microsystems. Sun was acquired by Oracle in 2009.
[Also see: Despite malware scanning, Chrome Web Store security still fall short]
"Sun pioneered the write once, infect everywhere model that Oracle has perpetuated," said Randy Abrams, research director for security adviser NSS Labs.
Because Google gathers enormous amounts of user data, Chrome Apps are unlikely to be welcomed by companies, Abrams said. "There are serious concerns as to privacy and data leakage when it comes to Google," he said. "Chrome Apps will be a huge concern for enterprises trying to protect intellectual property and other sensitive data, as well as a new security headache."
Vulnerabilities are a given in every software, so it is important to look at the vendor's track record for getting out patches quickly. While often criticized for making security blunders in Android, Google's mobile operating system, the company has incorporated strong security in the Chrome browser and in its Web services.
"They have been really impressive on the security side," said Wolfgang Kandek, chief technology officer for vulnerability management company Qualys.
Nevertheless, Google will have to provide a compelling reason to risk the inevitable vulnerabilities introduced with its new application platform. Simply offering to run software similar to what is already available for Windows or Mac OS X is unlikely to lure many users, and is certainly not worth the risk.
"From a security point of view, [Chrome Apps] is something to keep your eye on, because hackers love to go after things that are new and interesting," Court Little, senior service architect for managed security provider Solutionary, said.