Google Has Announced Silent ‘No Restart’ Chrome Security Patching
Wouldn’t it be great if the world’s most popular web browser, Google Chrome, with an estimated 3.5 billion users, just updated itself automatically when new security issues were found and fixed? I mean, it kind of does already, right? The updates are rolled out automatically, but the user needs to restart the browser for the fixes to be activated. Now Google has announced that dynamic patching, with Chrome silently being updated in the background and requiring no such restarts, is a thing. Sort of. “Dynamic patching sequentially replaces background child processes (like the Renderer and GPU) with updated binaries on the fly,” Google’s Chrome security team has confirmed. But I wouldn’t get too excited just yet, as there are a number of caveats that make this currently less groundbreaking than it first sounds.
Firstly, the feature as it stands is only available to users of the Chrome browser running on macOS. Google has said that it is looking for “opportune moments to restart automatically, when we can guarantee a seamless session restore,” and found one with Chrome 150 onwards on the Mac. You need to understand that macOS apps will typically continue to run in the background after the user has closed all open windows. And it is this unique macOS application state that has been leveraged by Google: “If Chrome detects a pending update while in this windowless state, it automatically restarts.”
So, let’s get this clear. If you have already closed all your tabs, Chrome for macOS will automatically update in the background without requiring a restart. Yet, dear reader, if you have already closed all your tabs, there’s not a lot of difference to be had, is there? Google even recognized this in its security announcement that was primarily concerned with the deployment of AI models at scale, making Chrome and the web safer for all. “People have understandable reasons to delay restarting Chrome,” it stated, adding that “a restart can be disruptive, requires scheduling in-between tasks, and is rarely the top priority at any given moment.”
The truth is that restarting Chrome has not interrupted tab usage for the longest time now, and your open tabs will simply reappear after the security patch has been applied and the browser pops back into action. I cannot, for the life of me, see how this is any different, in terms of benefit, from going and kickstarting the update yourself . In fact, the current method is probably less time-consuming, as you don’t even have to close all your tabs first.
Now, the motivation behind the move is a worthy one, don’t get me wrong. But the current limited implementation on Macs is nothing to get excited about. Longer term, Google said, it is looking for ways to prevent users from delaying Chrome restarts after an automatic update by exploring how to leverage the browser’s multi-process architecture. It also said that it is exploring ways to “ensure a seamless session restore even in complex cases, by saving more state locally,” with an ultimate goal of an always up-to-date browser that is “continuously and dynamically patched, and automatically restarted during opportune periods of minimal disruption.” Now that’s something I can get behind. After all, no user intervention is better than minimal user intervention, and anything that can help reduce the so-called patch gap has to be a good thing.
Loading article...