Skip to content

April 9, 2018

Chrome is scanning Windows, but it may be a bug

by John_A

A few days ago, Kelly Shortridge, a product manager at SecurityScorecard, discovered that Chrome was running AV scans of Windows devices.

I was wondering why my Canarytoken (a file folder) was triggering & discovered the culprit was chrome.exe. Turns out @googlechrome quietly began performing AV scans on Windows devices last fall. Wtf m8? This isn’t a system dir, either, it’s in Documents

— Kelly Shortridge (@swagitda_) March 29, 2018

This isn’t normal behavior from a web browser, but it does have a fairly benign explanation. Namely, it appears to be a bug related to some antivirus features that Google added to the Windows version of Chrome last year. The Chrome Cleanup tool is meant to help users restore control of hijacked systems. Justin Schuh, Google’s security lead, initially said that these scans were part of this anti-virus software.

“CCT isn’t a system-wide scan or filter,” Schuh tweeted. “It runs weekly, at background priority and normal user privs, for up to 15 mins. It scans browser hijacking points, which may cause it to follow links elsewhere. The engine is a heavily sandboxed subset of ESET.”

It turns out that wasn’t the real problem, however. Google later discovered that a bug was causing Chrome to begin file checks upon startup. The tool is meant to scan previously downloaded files, but a bug moved the scan to the start-up path, meaning it runs scans every time Chrome is opened. This can cause Windows computers to slow down when starting the browser. Google has said that it will patch the bug in a future patch. Clearing your download history might help reduce the slowdowns in the meantime.

Followed up with @swagitda_ and it turns out the log events weren’t CCT scans. Chrome existence-checks (code below) previously downloaded files, but a bug moved the checks into the startup path. Clearing download history stops the checks. Bug filed here:

— Justin Schuh

Even with these issues, Chrome is still a solid browser. If you’d rather explore some other options, you can check out our guide to the best web browsers in order to find one that suits you better.

Editors’ Recommendations

  • Chrome’s built-in scanning tool is now causing a privacy uproar
  • The best web browsers
  • A sneaky extension for Chrome, Firefox prevents its removal, hijacks browser
  • Microsoft misses another Edge-related 90-day security disclosure deadline
  • Escape reality with the best augmented reality apps for Android and iOS

Read more from News

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

Note: HTML is allowed. Your email address will never be published.

Subscribe to comments

%d bloggers like this: