Root Causes 490: Chrome and Chromium

Hosted by

Tim Callan

Chief Compliance Officer

Jason Soroko

Fellow

Original broadcast date

April 28, 2025

We define Chrome versus Chromium, explaining what each is and the difference between the two.

Podcast Transcript

Lightly edited for flow and brevity.

Tim CallanThere are a couple words that are used a lot in the world of browsers and internet and the WebPKI and I think almost nobody really understands what they signify and the significance matters. Those are Chrome and Chromium. And I guess we could also throw Google in the mix.

Jason SorokoGoodness. Even you and I, Tim, when we talk about Google's participation at the CA/Browser Forum, what we're really talking about is the Chrome Root Store Program. Chrome is their browser. Google's browser.

Tim CallanThe root store belongs to Chrome, not to Chromium. By the way, I've gotten that wrong in this podcast in the past, where the wrong word has come out. So, it's confusing.

Jason SorokoChromium is an open-source browser technology.

Tim CallanThat is the basis of Chrome and Edge, and I'll bet you some other stuff I don't know on the top of my head.

Jason SorokoBrave.

Tim CallanBrave. I didn't know that.

Jason SorokoSo, I read something recently from - not going to name names - somebody who should have known better. Everybody makes mistakes. They said, oh well, the Chrome Root Store Program - they said that totally correctly - is making a decision like as part of their rules and therefore all Chromium-based browsers are going to follow suit.

Tim CallanRight.

Jason SorokoWrong.

Tim CallanWrong. Edge uses the Windows Root Store.

Jason SorokoThere you go.

Tim CallanI don't know what Brave uses. Could be anything. Could be Mozilla.

Jason SorokoNow, little known fact unless you're in the Linux community, but on my Linux box, there's actually a browser, Chromium. So Chromium itself, the word is either the open-source browser technology, or it is actually a browser on Linux.

Tim CallanNow, let me ask you this, because I don't know the answer. Is the Linux Chromium browser based on the Chromium project? I would have figured.

Jason SorokoYes it is.

Tim CallanBut it's a Linux box. So is it using the Mozilla Root Store?

Jason SorokoYou got me.

Tim CallanMight be. Most Linux is.

Jason SorokoMost Linux is. Maybe that's why it's called Chromium rather than Chrome.

Tim CallanWell, if it's not from Chrome, it's not made by Google, it's not going to not gonna be called Chrome. That's Google's trademark.

Jason SorokoWell, no. But the thing is, I think that it could have been called Chrome, but then, because it perhaps isn't using the Chrome Root Store Program, it’s using Mozilla's.

Tim CallanWell and I don't believe that anybody outside of Chrome is using the Chrome Root Store Program. Remember, a couple things to know about the Chrome Root Store program. It actually came to the game fairly late. It still does not have 100% adoption. Chrome on iOS uses the Apple root store.

Jason SorokoYes. It’s just like Chromium probably on Linux using Mozilla.

Tim CallanProbably. Because of that though, Chrome, the browser, is insanely important. And though Chromium, the - what do I want to call it the browser foundation - is even more important because it's got Chrome and then some. From a root store perspective, it looks very different. Like you could look at published market share for the consumer facing browsers, and you'd say, okay, let me get this great straight. Chrome is 70% of the market and Mozilla is 7%. Okay. That means Chrome is 10 times as important as Mozilla. Well, not the root store, because the Mozilla root store touches all kinds of stuff that you don't think of as a classic human facing browser. So it turns into a very different pie chart, depending on what you're looking at.

Jason SorokoVarious operating systems really carry a lot of weight.

Tim CallanMicrosoft. Like you can't just look at the Edge market share to understand the importance of the Microsoft root store, because the Microsoft root store is sitting in every Windows machine in the world.

Tim CallanRegardless if you're using Edge or not. You’re probably doing something with that root program.

Tim CallanThat root program is affecting your computer. Like every auto update. That's not being done by your browser. Just because you say, I'm a Firefox user, that doesn't change what root store does the auto updates.

There's a bunch of stuff that's being decided by Windows that you don't even have a say in. I think that is a valid and important thing, and it's confusing as hell. Like I said, I go back and look at old podcast episodes and hear myself using the wrong word, and I try to be rigorous about it, and sometimes I think I don't even realize I'm doing it.

Jason SorokoThat's why we're doing this episode. It’s to help people to understand what the words are and it really was spurred in my head when I saw somebody say, basically the assumption was all Chromium-based browsers, including Edge, had to follow a specific rules of specific root store. That's not true.

Tim CallanI think there's the other bigger point that we kind of crept into it and we could keep going there if needed, but I think the point is made, is that it actually gets more complex than you would think in terms of what root store is affecting what process.

Jason SorokoThat's an important one. That could be a podcast all by itself. I think I'll keep it at this level, Tim. I think there's only one extra level of terminology that I want to bring up, and that's the rendering engine. So Chromium, technically, a rendering engine. What are equivalent peers in the world that we all use? WebKit. That's Safari. So Safari and I would say that Mozilla, Firefox is rendering action rendering is Mozilla. That's where the term Mozilla comes from. It's the rendering engine which gives the name to the root store program.

Tim CallanAlso, sometimes you get this phenomenon of, again, a completely invisible, I almost want to say white-labeled. So, for instance, I don't know the answer to this, but what is the browser rendering engine on the PS5? It's one of them.

Jason SorokoProbably a fork of WebKit. I'm gonna bet.

Tim CallanSo that's going to come with a root store. What's the rendering engine on the Nintendo Switch? That's going to come with a root store. So think about all the places. If your Smart TV lets you do internet browsing, what's that?

Jason SorokoThere are root stores, even if you're not browsing.

Tim CallanSure. Absolutely, because you're doing the same thing. You're doing software updates and all kinds of stuff. So, it's almost like every piece of electronics in your life that is accessing an internet based connection has a root store, and it's really one of about five, and good luck knowing which one.

Jason SorokoYet it is fundamentally important in terms of what is trusted by your system. And most of us have no idea what we're trusting. That's an episode for the future, Tim.

Tim CallanSure. That’s an episode that’s going to need a little research, I think.

Jason SorokoOh it does.

Tim CallanI don't know. I'm asking questions I just don't know the answer.

Jason SorokoThat shows you how complex it is. Like, we're totally, utterly imbued in this, and even we don't know.

Tim CallanWe don't know. You’d have to have very specific knowledge. There are people out there right now who know perfectly well the answer to these.

Jason SorokoA lot of it's not public information either.

Tim CallanThat's true. That's good point.

Jason SorokoWe could go forever on that.

Tim CallanThere’s a little meander.

Stay informed with expert insights

Subscribe to Root Causes for engaging discussions on PKI, digital security, and best practices for protecting your organization's critical assets. Don’t miss an episode!