Skip to content
Naked Security Naked Security

Microsoft’s gutting Edge and stuffing it with Chromium

Edge joins Chrome, Opera, Vivaldi, Yandex, and Brave. Better for web compatibility, but if one thing breaks, they all break.

Microsoft on Thursday announced that it’s going to spend the next year or so gutting its Edge browser and filling it with Chromium: the same open-source web rendering engine that powers Google’s Chrome browser (Chrome is Chromium with some Google extras), Opera, Vivaldi, Yandex, Brave and others.
This is an extraordinary step: some say it points to open source having won the browser wars, for better or worse. Better for web compatibility, says Microsoft, worse for a monoculture where if one thing breaks, a whole lot of other things break.
Terrible for any browser that’s trying to succeed outside of the near-total control of our online lives that Google already enjoys, Mozilla says. The open-source foundation regularly points out that Firefox is the only independent browser that isn’t tied to a profit-driven company, including Google with Chrome, Apple with Safari, and Microsoft with Edge.
Back in the day, Internet Explorer – the predecessor to Edge – not only ruled the browser roost; its stranglehold precipitated an epic antitrust case accusing Microsoft of abusing its monopoly position over Windows. But that was then, and this is now, and Explorer’s replacement, Edge, has a tiny share of the browser marketplace.


The way Microsoft sees it, with its embrace of Chromium, we’ll get the combined heft of Microsoft and Google contributing to the codebase, which could make it more secure. Unfortunately, it’s also going to create even more of a monoculture. If something goes wrong, it goes wrong in a lot of places. A flaw in the HTML or JavaScript engines becomes a flaw in Chrome, Chromium, Edge, Opera and others.
Microsoft’s Joe Belfiore, corporate vice president of Windows, paints the prospect of a Chromium-based Edge as a compatibility heaven for users and corporate IT, and a headache-reducing improvement for developers:

Ultimately, we want to make the web experience better for many different audiences. People using Microsoft Edge (and potentially other browsers) will experience improved compatibility with all web sites, while getting the best-possible battery life and hardware integration on all kinds of Windows devices.
Web developers will have a less-fragmented web platform to test their sites against, ensuring that there are fewer problems and increased satisfaction for users of their sites; and because we’ll continue to provide the Microsoft Edge service-driven understanding of legacy IE-only sites, Corporate IT will have improved compatibility for both old and new web apps in the browser that comes with Windows.

Why now?

Edge had about 4% of the browser market as of August. Chrome had about 67%. In effect, Chrome is the new IE.
In order to change that, Microsoft needs to supply a browser that businesses can run across all versions of Windows. That’s one thing that the Chromium move will accomplish: a Chromium-based Edge won’t be exclusive to Windows 10, and can instead be run on Windows 7, Windows 8.1 and even on macOS.
It also means that Microsoft will be able to update the browser more frequently, though whether that happens monthly isn’t clear. What is clear: updates will no longer be tied to every major Windows 10 update.
The Verge reports that Microsoft has been mulling this move for at least a year, pushed by consumers and businesses who want to see the company improve web compatibility. Edge has been getting better, but even small compatibility issues have made it a rocky road for users.
We don’t yet know the technical details of how this is going down. But according to Mary Jo Foley over at ZDNet’s All About Microsoft, it’s looking like Microsoft will swap out its EdgeHTML rendering engine for Chromium’s Blink engine, and possibly its Chakra JavaScript engine for Chromium’s V8.
Will this improve Edge’s teensy market share? That remains to be seen. But as far as Mozilla CEO Chris Beard is concerned, this is Goodbye to EdgeHTML, hello to even more control over online life being handed to Google. Browser engines may be invisible to users, he wrote in a blog on Thursday, but they hold great sway over what can be done online and what developers prioritize:

The ‘browser engines’ – Chromium from Google and Gecko Quantum from Mozilla – are ‘inside baseball’ pieces of software that actually determine a great deal of what each of us can do online. They determine core capabilities such as which content we as consumers can see, how secure we are when we watch content, and how much control we have over what websites and services can do to us. Microsoft’s decision gives Google more ability to single-handedly decide what possibilities are available to each one of us.

Readers, what do you think of this move: can we expect better security with Google and Microsoft both contributing to the Chromium codebase? Will that be worth Google tightening its grip on our online lives? Please do chime in below.

26 Comments

If MS can string together a stable, non spying/secure, “business environment friendly”, AD/GP manageable browser, that would be really good. But from the looks of W10, those won’t be any of their priorities. It will be stuffed with Xbox add ins that can’t be removed, Skype will be it’s main code, and One drive will prompt you to log in every time you click on a new tab. We need a software company that understands business needs.
A full replacement for MS AD system would be nice too.

Reply

Security aside, it’s about time that Microsoft moves to a standards-based browser. This is a big win for web developers.

Reply

This is a big win for web developers – YES!!

Reply

History is not on your side here. The last time the web descended into something close to a browser monoculture (the era of Internet Explorer 4, 5 and 6) it turned out to be really bad news for web developers.

Reply

I would much prefer that MS _made_ a standards compliant browser.
If it simply can’t do that, I’d much prefer that MS adopt the Gecko and SpiderMonkey components from Firefox.
This is just handing the keys to the web to Google. MS is signalling that it will no longer carry the enormous cost of developing a web browser for the meagre market share it gets. Google will have the whip hand when it comes to deciding on the direction of Chromium development and MS will be its client.
The Google-owned, AMP-based web just moved a little closer.

Reply

I would think this would make online tracking more efficient.

Reply

The tracking parts are in the code that Google ads to the Chromium code to turn it into Google Chrome. MS is using parts of the Chromium codebase, so no reason to assume it will make tracking (by Google) easier.

Reply

I am not an expert, or even close to one, but I am sick and tired of Google. The reason I downloaded it in the first place, was the fact that IT people kept telling me that it’s always a good idea to have a backup browser. I have used IE for years. I discovered recently that Google somehow downloaded JavaScript onto my computer. JavaScript does not show in any of my installed programs, but if I do use Google, browsing is limited because I removed JavaScript. The idea that Microsoft is giving in to this Chromium, tells me that had Microsoft listened to its customers when they introduced Windows 8 and Edge as its browser, perhaps IE wouldn’t be where it is in the market share. Updating programming isn’t always the best way to go…Microsoft! After reading this article, maybe I should just throw my computer out the door, because there have been many times I’ve wanted to do that.

Reply

Have tried Edge and have to keep reporting lags and freezing to MS (actually just a few days ago). Do hate to see a monoculture in the browser environment but I guess with little imagination at MS there is not much choice for them.

Reply

> worse for a monoculture where if one thing breaks, a whole lot of other things break
True, but with increased use of the same guts, breaks will get fixed faster.
Allow me to rephrase:
A greater subset of the proletariat will clamor for a fix, which (hopefully) will lead to quicker fix times.

Reply

As web-developer it is a great news, we are finally done with crap browsers from Microsoft. I just like any web developer spent countless hours trying to fix bugs and make things work in IE6 back in the days, and really happy that those days are gone, finally. However, I do also have some privacy concerns, Google already controls to much of our lives…

Reply

Hahah, holy crap, yes! Endless hair-pulling, expletive-hurling, envelope-stretching customizations in tags beginning thus:
[if ie6 ….

Reply

Uggh. I must run a not-so-well maintained web-hosted application. I usually run it on Chrome. Recently it started giving me the mobile version on Chrome with frames sized strangely for a desktop machine. It ran fine on Edge. Just as you suggest, when this change takes place it will be a fail-everywhere situation.

Reply

Now wouldn’t it be nice to see a ‘Chromebook’-like offering from Mozilla… Firebook maybe?

Reply

I know Mozilla makes a phone operating system, but most of the customers for what you are suggesting probably would go through one of the linux distros.

Reply

“A flaw in the HTML or JavaScript engines becomes a flaw in Chrome, Chromium, Edge, Opera and others.” Uh, not entirely true. The WebKit subscribers list will be Chrome, Chromium, Edge and Safari; as far as I know, Opera still uses Presto.

Reply

IIRC, Opera switched to the WebKit renderer back in 2013. Yep, here you are:
https://nakedsecurity.sophos.com/2013/04/04/google-announces-brand-new-web-browser-core-so-does-mozilla/
2013 is how Wikipedia remembers it too, FWIW.

Reply

If someone would please answer my question, I would be a happy person. I am a MS Windows 7 hold-out, and because MS has advertised that it will continue to support Windows 7 until January 14, 2020, I haven’t had many concerns until the last month or so. Suddenly, websites I use just about everyday, flash a message stating that I am not using an updated browser. Apparently just because Microsoft states one thing, other companies don’t seem to care. So I am forced to use Google, my favorite?!!?? In order to use Google I am forced to allow JavaScript to run. And, since I’ve been told, and I’ve read, and heard over and over again NOT to use JavaScript what is a person to do?????
I just want to turn on my computer, do what I what to do, and not have to worry about coding languages, unstable frameworks, and whatever else I’m supposed to worry about. From everything I’ve read, JS isn’t going away anytime soon. Finally my question: What will or will not happen if I use JS? Sophos, even your site tells me not to use JS. What is a person to do??

Reply

We don’t tell people “don’t use JavaScript in your browser” (though we do sometimes talk about add-on tools – the best known is probably a free product called NoScript that can limit the power of browser JavaScript).
We do advise people not to use *Java* in their browsers – but Java and JavaScript are two different things:
https://nakedsecurity.sophos.com/2013/01/16/java-is-not-javascript-tell-your-friends/
If you don’t like Google’s browser, try Mozilla Firefox. It’s popular, well-regarded and receives regular security updates.

Reply

Paul,
Thank you so much for the clarification. I noticed that both Google and Microsoft do use JavaScript in their browsers. What was confusing was the fact that at one point in time, JavaScript actually showed up as an installed program on my computer so that’s when I uninstalled it. But I did find JS installed on IE and Google’s browsers.
Now, the latest occurrence is websites that flash a message stating: “We’ve made updates that may impact your Ancestry experience. Certain features on Ancestry may have reduced functionality or may not be supported when using Internet Explorer 8, 9, or 10. Check out the recommended browsers for more information.” This is not the only website I use that is no longer supporting IE. Why is this? This just started a couple of weeks ago.
Thank you again.

Reply

Chrome filled that need for a browser that was simple and practical. It just worked and that was all most want in a web browser. The end result is most browser developers realizing the Chromium makes life simpler in developing their own browser. Microsoft realized this as well, because EdgeHtml was a chore to develop.

Reply

Leave a Reply

Your email address will not be published. Required fields are marked *

Subscribe to get the latest updates in your inbox.
Which categories are you interested in?
You’re now subscribed!