A few days ago, Kelly Shortridge, a product manager at SecurityScorecard, discovered that Chrome was running AV scans of Windows devices.
I was wondering why my Canarytoken (a file folder) was triggering & discovered the culprit was chrome.exe. Turns out @googlechrome quietly began performing AV scans on Windows devices last fall. Wtf m8? This isn’t a system dir, either, it’s in \Documents\ pic.twitter.com/IQZPSVpkz7
— Kelly Shortridge (@swagitda_) March 29, 2018
This isn’t normal behavior from a web browser, but it does have a fairly benign explanation. Namely, it appears to be a bug related to some antivirus features that Google added to the Windows version of Chrome last year. The Chrome Cleanup tool is meant to help users restore control of hijacked systems. Justin Schuh, Google’s security lead, initially said that these scans were part of this anti-virus software.
“CCT isn’t a system-wide scan or filter,” Schuh tweeted. “It runs weekly, at background priority and normal user privs, for up to 15 mins. It scans browser hijacking points, which may cause it to follow links elsewhere. The engine is a heavily sandboxed subset of ESET.”
It turns out that wasn’t the real problem, however. Google later discovered that a bug was causing Chrome to begin file checks upon startup. The tool is meant to scan previously downloaded files, but a bug moved the scan to the start-up path, meaning it runs scans every time Chrome is opened. This can cause Windows computers to slow down when starting the browser. Google has said that it will patch the bug in a future patch. Clearing your download history might help reduce the slowdowns in the meantime.
Followed up with @swagitda_ and it turns out the log events weren’t CCT scans. Chrome existence-checks (code below) previously downloaded files, but a bug moved the checks into the startup path. Clearing download history stops the checks. Bug filed here: https://t.co/gLNHJRSGq2pic.twitter.com/r0aeVAsurr
— Justin Schuh
Even with these issues, Chrome is still a solid browser. If you’d rather explore some other options, you can check out our guide to the best web browsers in order to find one that suits you better.
