Comment by jeffbee
17 hours ago
This is actually the perfect detail to discuss. ChromeOS printing is literally just CUPS, so it has the same functionality as any other Linux distro. If you have a modern IPP printer on a normal home Wi-Fi, you can expect it to just work. This covers most people's needs.
Where ChromeOS shines is that it has never been affected by severe and numerous CUPS security vulnerabilities like CVEs 2024-47175 through 2024-47177, which were unauthenticated remote vulnerabilities, while Ubuntu and Fedora (and all other major distros) were affected. Why? ChromeOS sandboxes the hell out of these kinds of subsystems. CUPS runs in a PID namespace, network namespace, mount namespace, on a read-only filesystem, with seccomp filters. It cannot use the network, ever. It can only communicate over a pipe with a network proxy. The proxy is only active if and when a user tries to print. The proxy is also in a seccomp jail that prevents it from doing anything except enumerated network traffic and the pipe. The proxy is written in a safer language than CUPS itself, and protects CUPS from malformed, malicious inputs by validating both PPDs and print requests.
That sounds like some nice engineering.