Vulnerabilities / Threats
11:34 AM

Google Chrome 19 Debuts, With 20 Bug Patches

Latest release of browser also adds the ability to synchronize open tabs across devices.

Google Drive: 10 Alternatives To See
Google Drive: 10 Alternatives To See
(click image for larger view and for slideshow)
Google Tuesday released version 19 of its Chrome browser, which includes fixes for 20 vulnerabilities, as well as a new feature for sharing open tabs across different devices. But Google said the feature won't be widely available for another few weeks.

The new version of Chrome is available for Windows, Mac, Linux, and Chrome Frame. All current Chrome installations should auto-update to the latest version over the next few days.

Google releases a new, stable version of Chrome about every six to eight weeks.

With the release of Chrome 19, Google also distributed $7,500 as part of its bug bounty program. None of the patched bugs were "critical," meaning--per the Common Vulnerability Scoring System (CVSS)--that attackers could have potentially used them to remotely execute arbitrary code. However, eight of the vulnerabilities patched in the new version of Chrome are of "high" severity, seven are ranked as "medium," and five are of "low" severity.

[ Read It's Browser Version Madness! ]

Six of the bugs were spotted by Google or the broader Chromium (Google Chrome OS) community. A low-risk, Windows-only "bad search path for Windows Media Player plug-in" bug was credited to Microsoft and Microsoft Vulnerability Research.

Full information about all of the bugs has yet to be released; Google typically waits to release detailed information until the majority of Chrome users have received related patches. But many of the patched bugs relate to memory errors in C/C++. Not coincidentally, Google said that a homegrown tool, AddressSanitizer, had been used by researchers to detect many of the patched vulnerabilities.

Unusually, Google also distributed an additional $9,000 in rewards to Aki Helin at the Oulu University Secure Programming Group in Finland, as well as Sławomir Błażek, Chamal de Silva, miaubiz, Arthur Gerkis, and Christian Holler "for working with us during the development cycle and preventing security regressions from ever reaching the stable channel." All feature prominently in Google's Security Hall of Fame, which lists researchers who have helped "make Chromium safer."

Google software engineer and "tab-wrangling server jockey" Raz Mathias explained how Chrome's new tab synchronization feature will work. "When you're signed in to Chrome, your open tabs are synced across all your devices, so you can quickly access them from the 'Other devices' menu on the New Tab page," he said in a blog post. "If you've got Chrome for Android Beta, you can open the same recipe tab right on your phone when you run out to the store for more ingredients. The back and forward buttons will even work, so you can pick up browsing right where you left off."

Chrome isn't the only browser now offering tab synchronization. Notably, Mozilla added tab synchronization to Firefox 4, which it released in 2010.

At this interactive Enterprise Mobility Virtual Event, experts and solution providers will offer detailed insight into how to bring some order to the mobile industry innovation chaos. When you register, you will gain access to live webcast presentations and virtual booths packed with free resources. It happens May 17.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
According to industry estimates, about a million new IT security jobs will be created in the next two years but there aren't enough skilled professionals to fill them. On top of that, there isn't necessarily a clear path to a career in security. Dark Reading Executive Editor Kelly Jackson Higgins hosts guests Carson Sweet, co-founder and CTO of CloudPassage, which published a shocking study of the security gap in top US undergrad computer science programs, and Rodney Petersen, head of NIST's new National Initiative for Cybersecurity Education.