News

Google Extending Chrome Support for Windows XP

• By Kurt Mackie
• 10/16/2013

Google plans to extend security and patch support for its Chrome browser running on Microsoft's Windows XP until April 2015.

That date is one year later than Microsoft's "extended support" lifecycle phase-out date for its Windows XP operating system. On April 8, 2014, Microsoft's security patch support will come to an end for the 12-year-old Windows XP. Organizations that continue to run the unsupported OS after that date may face future security issues.

Google acknowledged in an announcement on Wednesday that "hundreds of millions of users, including a good chunk of current Chrome users" that "still rely on XP" may be slow in moving off Windows XP. Consequently, it plans to send "regular updates and security patches until at least April 2015" for its Chrome browser running on Windows XP to protect against both phishing attacks and malware.

It's not clear how secure a patched browser would be running atop an unpatched OS. However, Google also offers its "Chrome Legacy Browser Support extension" that promises legacy browser support for organizations. It's an add-on to Internet Explorer that will switch to an optimal browser based on which legacy Web app or Web site gets accessed, according to Google's description.

"If you're an IT administrator and your employees depend on web applications built for older browsers, you can use Legacy Browser Support to set Chrome as the primary browser and limit the usage of the unsupported, legacy browser to only specific web apps," Google explained in its announcement.

However, those organizations considering using Microsoft's Internet Explorer 8 browser with Google's Legacy Browser Support also face a security dilemma.

IE 8 Support Going Away
Microsoft's Internet Explorer 8 browser, which is the most recent browser supported by Windows XP, also will lose extended support on the same date as its underlying OS, which will be April 8, 2014 in the case of running IE 8 on Windows XP, according to Microsoft's lifecycle policy for IE 8 and its lifecycle policy for Windows XP. Microsoft considers Internet Explorer to be a component of Windows.

No extensions to these product end-of-life plans for IE 8 and Windows XP have been announced by Microsoft, which makes Google's promise of extended support for Chrome on Windows XP seem almost charitable by comparison. On other products, Google has simply dropped support. For instance, Google dropped support for IE 8 running Google Apps almost a year ago. Google and Microsoft have also seemingly have had back-and-forth spats over other product-support milestones, such as Google's fading support for Microsoft's Exchange Active Sync protocol.

The IE 8 end-of-life problem affects organizations that tap software-as-a-service (SaaS) applications, too, according to Gary Schare, president and chief operating officer at Browsium.

"Many software vendors (particularly SaaS vendors) have dropped or are dropping support for IE 8," Schare commented in an e-mailed response. "The first group includes Google Apps, Salesforce.com and Workday. The latter includes Microsoft when they drop support for IE 8 for Office 365 next spring."

Schare, whose past career included serving 14 years at Microsoft on the IE team before heading Browsium, noted that organizations may still face problems if their Web applications remain dependent on Microsoft's IE 8 browser technology.

"Enterprises running IE 8 on XP can't switch to Chrome for security reasons since they have loads of IE-dependent apps," he contended. "But they could switch to Chrome for general Web browsing (which will improve security) and to access modern SaaS apps like the ones I listed."

Browsium blazed a trail with its Ion remediation solution that supports running legacy Web pages and Web apps via tabs in newer versions of Internet Explorer. It also created its Catalyst configuration tool that lets IT pros configure the use of specific browser technologies for specific applications and Web sites. The latter product sounds a bit like Google's Legacy Browser Support product, but Google's approach is less robust, according to Schare.

"[Google's] Legacy Browser Support is a much lighter weight tool for managing browser traffic than Catalyst," Schare said. "It tends to appeal to small orgs running Google Apps -- usually 10 users up to a few hundred. Catalyst is much more functional and enterprise-ready. We have customers with north of 50,000 seats using it."

Windows XP's Slow Death
Microsoft's Windows XP is still widely used. September data from Net Applications showed Windows XP use at 31 percent out of all operating systems used worldwide. Last month, Microsoft's Chief Operating Officer Kevin Turner said that worldwide Windows XP use was at 21 percent, according to Microsoft. Turner added that Microsoft is expecting Windows XP use to hit 13 percent by April. However, that still leaves plenty of organizations potentially using an insecure OS. A July industry survey conducted this summer pegged Windows XP use at 28 percent.

"Regardless of whose numbers you read, the XP to Windows 7 migration problem is still huge," Schare said. "Hundreds of millions of PCs around the world still run XP."

Organizations have a few options for getting off Windows XP, although the time to complete an OS migration is ticking down. For a summary of approaches, see this article.