Ref:Stable Channel Update
The Stable Channel has been updated to 34.0.1847.131 for Windows, Mac, and 34.0.1847.132 for Linux.
This release also contains a Flash Player update, to version 13.0.0.206.
The Stable Channel has been updated to 34.0.1847.137 for Windows, Mac and Linux.
This release also contains a Flash Player update, to version 13.0.0.214.
Security Fixes and Rewards
This update includes 3 security fixes. Below, we highlight fixes that were either contributed by external researchers or particularly interesting. Please see the Chromium security page for more information.
[$2000][358038] High CVE-2014-1740: Use-after-free in WebSockets. Credit to Collin Payne.
[$1500][349898] High CVE-2014-1741: Integer overflow in DOM ranges. Credit to John Butler.
[$1000][356690] High CVE-2014-1742: Use-after-free in editing. Credit to cloudfuzzer.
Two of the bugs above were detected using AddressSanitizer.
This release fixes a number of crashes and other bugs. A full list of changes is available in the SVN log. If you find a new issue, please let us know by filing a bug.
Daniel Xie
Google Chrome
http://googlechromereleases.blogspot.co.uk/Stable Channel Update
The Chrome Team is excited to announce the promotion of Chrome 35 to the Stable channel for Windows, Mac, and Linux. Chrome 35.0.1916.114 contains a number of fixes and improvements, including:
Security Fixes and Rewards
- More developer control over touch input
- New JavaScript features
- Unprefixed Shadow DOM
- A number of new apps/extension APIs
- Lots of under the hood changes for stability and performance
This update includes 23 security fixes. Below, we highlight fixes that were either contributed by external researchers or particularly interesting. Please see the Chromium security page for more information.
[$3000][356653] High CVE-2014-1743: Use-after-free in styles. Credit to cloudfuzzer.
[$3000][359454] High CVE-2014-1744: Integer overflow in audio. Credit to Aaron Staple.
[$1000][346192] High CVE-2014-1745: Use-after-free in SVG. Credit to Atte Kettunen of OUSPG.
[$1000][364065] Medium CVE-2014-1746: Out-of-bounds read in media filters. Credit to Holger Fuhrmannek.
[$1000][330663] Medium CVE-2014-1747: UXSS with local MHTML file. Credit to packagesu.
[$500][331168] Medium CVE-2014-1748: UI spoofing with scrollbar. Credit to Jordan Milne.
As usual, our ongoing internal security work responsible for a wide range of fixes:
- [374649] CVE-2014-1749: Various fixes from internal audits, fuzzing and other initiatives.
- [358057] CVE-2014-3152: Integer underflow in V8 fixed in version 3.25.28.16.
Many of the above bugs were detected using AddressSanitizer.
Interested in switching release channels? Find out how. If you find a new issue, please let us know by filing a bug.
Karen Grünberg
Google Chrome
Stable Channel Update
The Stable Channel has been updated to 35.0.1916.153 for Windows, Mac and Linux.
This release contains a Flash Player update.
Security Fixes and Rewards
This update includes 4 security fixes. Below, we highlight fixes that were either contributed by external researchers or particularly interesting. Please see the Chromium security page for more information.
[$1000][369525] High CVE-2014-3154: Use-after-free in filesystem api. Credit to Collin Payne.
[$1000][369539] High CVE-2014-3155: Out-of-bounds read in SPDY. Credit to James March, Daniel Sommermann and Alan Frindell of Facebook.
[$500][369621] Medium CVE-2014-3156: Buffer overflow in clipboard. Credit to Atte Kettunen of OUSPG.
As usual, our ongoing internal security work was responsible for the following fix:
Many of the above bugs were detected using AddressSanitizer.
- [368980] CVE-2014-3157: Heap overflow in media.
This release fixes a number of crashes and other bugs. A full list of changes is available in the SVN log. If you find a new issue, please let us know by filing a bug.
Karen Grünberg
Google Chrome
ref:Stable Channel Update
The Chrome Team is excited to announce the promotion of Chrome 36 to the Stable channel for Windows, Mac and Linux. Chrome 36.0.1985.125 contains a number of fixes and improvements, including:
- Rich Notifications Improvements
- An Updated Incognito / Guest NTP design
- The addition of a Browser crash recovery bubble
- Chrome App Launcher for Linux
- Lots of under the hood changes for stability and performance
Security Fixes and Rewards
This update includes 26 security fixes. Below, we highlight fixes that were either contributed by external researchers or particularly interesting. Please see the Chromium security page for more information.
[$2000][380885] Medium CVE-2014-3160: Same-Origin-Policy bypass in SVG. Credit to Christian Schneider.
As usual, our ongoing internal security work responsible for a wide range of fixes:
Many of the above bugs were detected using AddressSanitizer.
- [393765] CVE-2014-3162: Various fixes from internal audits, fuzzing and other initiatives.
Interested in switching release channels? Find out how. If you find a new issue, please let us know by filing a bug.
Matthew Yuan
Google Chrome
This release contains a Flash Player update.
Security Fixes and Rewards
This update includes 12 security fixes. Below, we highlight fixes that were either contributed by external researchers or particularly interesting. Please see the Chromium security page for more information.
[$2000][390174] High CVE-2014-3165: Use-after-free in web sockets. Credit to Collin Payne.
[398925] High CVE-2014-3166: Information disclosure in SPDY. Credit to Antoine Delignat-Lavaud.
As usual, our ongoing internal security work responsible for a wide range of fixes:
Many of the above bugs were detected using AddressSanitizer.
- [400950] CVE-2014-3167: Various fixes from internal audits, fuzzing and other initiatives.
This release fixes a number of crashes and other bugs. A full list of changes is available in the SVN log. If you find a new issue, please let us know by filing a bug.
Stable Channel Update
The Chrome team is delighted to announce the promotion of Chrome 37 to the stable channel for Windows, Mac and Linux. Chrome 37.0.2062.94 contains a number of fixes and improvements, including:
- DirectWrite support on Windows for improved font rendering
- A number of new apps/extension APIs
- Lots of under the hood changes for stability and performance
A full list of changes is available in the log.
Security Fixes and Rewards
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.
This update includes 50 security fixes. Below, we highlight fixes that were either contributed by external researchers or particularly interesting. Please see the Chromium security page for more information.
[$30000][386988] Critical CVE-2014-3176, CVE-2014-3177: A special reward to lokihardt@asrt for a combination of bugs in V8, IPC, sync, and extensions that can lead to remote code execution outside of the sandbox.
[$2000][369860] High CVE-2014-3168: Use-after-free in SVG. Credit to cloudfuzzer.
[$2000][387389] High CVE-2014-3169: Use-after-free in DOM. Credit to Andrzej Dyjak.
[$1000][390624] High CVE-2014-3170: Extension permission dialog spoofing. Credit to Rob Wu.
[$4000][390928] High CVE-2014-3171: Use-after-free in bindings. Credit to cloudfuzzer.
[$1500][367567] Medium CVE-2014-3172: Issue related to extension debugging. Credit to Eli Grey.
[$2000][376951] Medium CVE-2014-3173: Uninitialized memory read in WebGL. Credit to jmuizelaar.
[$500][389219] Medium CVE-2014-3174: Uninitialized memory read in Web Audio. Credit to Atte Kettunen from OUSPG.
We would also like to thank Collin Payne, Christoph Diehl, Sebastian Mauer, Atte Kettunen, and cloudfuzzer for working with us during the development cycle to prevent security bugs from ever reaching the stable channel. $8000 in additional rewards were issued.
As usual, our ongoing internal security work responsible for a wide range of fixes:
[406143] CVE-2014-3175: Various fixes from internal audits, fuzzing and other initiatives (Chrome 37).
Many of the above bugs were detected using AddressSanitizer.
Interested in switching release channels? Find out how. If you find a new issue, please let us know by filing a bug.
Alex Mineer
Google Chrome
This is indeed something new and opt-in.I see that there is an opt-in opportunity for the 64 bit version.
Is this something new or has it always been the case.
http://blog.chromium.org/2014/08/64...geek&utm_medium=email&utm_campaign=newsletter
Stable Channel Update
The stable channel has been updated to 37.0.2062.102 for Windows. This corrects a bug which led to multi-byte characters sometimes not being rendered on Windows.
Stable Channel Update
The stable channel has been updated to 37.0.2062.103 for Windows. This addresses some user feedback related to how Chrome renders text when display scaling is set to 125% or lower.
As always, if you find a new issue, please let us know by filing a bug.
Alex Mineer
Google Chrome
Stable Channel Update
The stable channel has been updated to 37.0.2062.120 for Windows, Mac and Linux.
This release contains an update for Adobe Flash as well as a number of other fixes. A full list of changes is available in the log.
Security Fixes and Rewards
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.
This update includes 4 security fixes. Below, we highlight fixes that were either contributed by external researchers or particularly interesting. Please see the Chromium security page for more information.
[$2000][401362] High CVE-2014-3178: Use-after-free in rendering. Credit to miaubiz.
As usual, our ongoing internal security work responsible for a wide range of fixes:
[411014] CVE-2014-3179: Various fixes from internal audits, fuzzing and other initiatives.
Many of the above bugs were detected using AddressSanitizer.
Interested in switching release channels? Find out how. If you find a new issue, please let us know by filing a bug.
Alex Mineer
Google Chrome
Stable Channel Update
The Chrome team is delighted to announce the promotion of Chrome 38 to the stable channel for Windows, Mac and Linux. Chrome 38.0.2125.101 contains a number of fixes and improvements, including:
- A number of new apps/extension APIs
- Lots of under the hood changes for stability and performance
A full list of changes is available in the log.
Security Fixes and Rewards
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.
This update includes 159 security fixes, including 113 relatively minor fixes found usingMemorySanitizer. Below, we highlight fixes that were either contributed by external researchers or particularly interesting. Please see the Chromium security page for more information.
[$27633.70][416449] Critical CVE-2014-3188: A special thanks to Jüri Aedla for a combination of V8 and IPC bugs that can lead to remote code execution outside of the sandbox.
[$3000][398384] High CVE-2014-3189: Out-of-bounds read in PDFium. Credit to cloudfuzzer.
[$3000][400476] High CVE-2014-3190: Use-after-free in Events. Credit to cloudfuzzer.
[$3000][402407] High CVE-2014-3191: Use-after-free in Rendering. Credit to cloudfuzzer.
[$2000][403276] High CVE-2014-3192: Use-after-free in DOM. Credit to cloudfuzzer.
[$1500][399655] High CVE-2014-3193: Type confusion in Session Management. Credit to miaubiz.
[$1500][401115] High CVE-2014-3194: Use-after-free in Web Workers. Credit to Collin Payne.
[$4500][403409] Medium CVE-2014-3195: Information Leak in V8. Credit to Jüri Aedla.
[$3000][338538] Medium CVE-2014-3196: Permissions bypass in Windows Sandbox. Credit to James Forshaw.
[$1500][396544] Medium CVE-2014-3197: Information Leak in XSS Auditor. Credit to Takeshi Terada.
[$1500][415307] Medium CVE-2014-3198: Out-of-bounds read in PDFium. Credit to Atte Kettunen of OUSPG.
[$500][395411] Low CVE-2014-3199: Release Assert in V8 bindings. Credit to Collin Payne.
We would also like to thank Atte Kettunen of OUSPG and Collin Payne for working with us during the development cycle to prevent security bugs from ever reaching the stable channel. $23,000 in additional rewards were issued.
As usual, our ongoing internal security work responsible for a wide range of fixes:
[420899] CVE-2014-3200: Various fixes from internal audits, fuzzing and other initiatives (Chrome 38).
Multiple vulnerabilities in V8 fixed at the tip of the 3.28 branch (currently 3.28.71.15).
Some of the above bugs were also detected using AddressSanitizer.
Interested in switching release channels? Find out how. If you find a new issue, please let us know by filing a bug.
Matthew Yuan
Google Chrome
Stable Channel Update
The stable channel has been updated to 38.0.2125.104 for Windows, Mac and Linux.
This release contains an update for Adobe Flash as well as a number of other fixes. A full list of changes is available in the log.
Interested in switching release channels? Find out how. If you find a new issue, please let us know by filing a bug.
Matthew Yuan
Google Chrome
Stable Channel Update
The stable channel has been updated to 38.0.2125.111 for Windows, Mac and Linux. A full list of changes is available in the log.
Stable Channel Update
The stable channel has been updated to 38.0.2125.122 for Windows, Mac and Linux.
This release contains an update for Adobe Flash as well as a number of other fixes. A full list of changes is available in the log.
Stable Channel Update
The Chrome team is delighted to announce the promotion of Chrome 39 to the stable channel for Windows, Mac and Linux. Chrome 39.0.2171.65 contains a number of fixes and improvements, including:
A partial list of changes is available in the log.
- 64-bit support for Mac
- A number of new apps/extension APIs
- Lots of under the hood changes for stability and performance
Security Fixes and Rewards
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.
This update includes 42 security fixes. Below, we highlight fixes that were either contributed by external researchers or particularly interesting. Please see the Chromium security page for more information.
[$500][389734] High CVE-2014-7899: Address bar spoofing. Credit to Eli Grey.
[$1500][406868] High CVE-2014-7900: Use-after-free in pdfium. Credit to Atte Kettunen from OUSPG.
[$1000][413375] High CVE-2014-7901: Integer overflow in pdfium. Credit to cloudfuzzer.
[$1000][414504] High CVE-2014-7902: Use-after-free in pdfium. Credit to cloudfuzzer.
[$3000][414525] High CVE-2014-7903: Buffer overflow in pdfium. Credit to cloudfuzzer.
[$2000][418161] High CVE-2014-7904: Buffer overflow in Skia. Credit to Atte Kettunen from OUSPG.
[$2000][421817] High CVE-2014-7905: Flaw allowing navigation to intents that do not have the BROWSABLE category. Credit to WangTao(neobyte) of Baidu X-Team.
[$500][423030] High CVE-2014-7906: Use-after-free in pepper plugins. Credit to Chen Zhang (demi6od) of the NSFOCUS Security Team.
[$7500][423703] High CVE-2014-0574: Double-free in Flash. Credit to biloulehibou.
[$5000][424453] High CVE-2014-7907: Use-after-free in blink. Credit to Chen Zhang (demi6od) of the NSFOCUS Security Team.
[$500][425980] High CVE-2014-7908: Integer overflow in media. Credit to Christoph Diehl.
[$500][391001] Medium CVE-2014-7909: Uninitialized memory read in Skia. Credit to miaubiz.
We would also like to thank Atte Kettunen, Christian Holler, cloudfuzzer, and mmaliszkiewicz for working with us during the development cycle to prevent security bugs from ever reaching the stable channel. $16500 in additional rewards were issued.
As usual, our ongoing internal security work was responsible for a wide range of fixes:
[433500] CVE-2014-7910: Various fixes from internal audits, fuzzing and other initiatives.
Many of the above bugs were detected using AddressSanitizer or MemorySanitizer.
Interested in switching release channels? Find out how. If you find a new issue, please let us know by filing a bug.
Alex Mineer
Google Chrome