In order for the CRIME attack to work, both the server and the client need to support the compression feature.

Internet Explorer never supported TLS compression or SPDY. Mozilla Firefox only supports SPDY, but compression was removed in Firefox 15, so the latest stable version of the browser is now protected against CRIME, Rizzo said.

Google Chrome supported both TLS compression and SPDY compression, but the features were removed from the latest version.

It's not yet clear if the Android versions of Chrome and Firefox have been patched.

Ristic believes that in the case of CRIME, the problem is not very serious because compression can easily be disabled both on clients and servers by applying patches.