I wonder if it really doubles the attack surface area.
If Chrome Frame works the way I understand it does, with Chrome basically sitting in the rendering area of IE, taking UI commands from it and interpreting all the incoming markup/code itself then I would have to guess that the answer is no.
The only public facing interface should be Chrome's, but I'd have to do a bunch more research to confirm that for sure...
If he has an exploit for chrome, he is going to add the magic tag and let ChromeFrame render the code thus the browser is vulnerable.
If he has an exploit for IE, he isn't going to add the magic tag, IE's engine is going to handle the rendering and the browser is vulnerable.
The key is that the attacker can choose what browser the victim is using, thus he can target either browser.
I absolutely agree. Letting the website choose is just adding attack vectors.
Having the site control when GF is used is essential for this to work.
Allowing the user control, rather than the website, means the user will get the benefit of Chrome Frame by default rather than as the exception and will stop a potential attacker from getting to choose their attack vector...
In my mind having two browsers would be an advantage security wise.