Vulnerabilities

Chrome 106 Update Patches Several High-Severity Vulnerabilities

Google announced on Tuesday that the latest Chrome update patches six high-severity vulnerabilities, including four use-after-free bugs.

All the newly resolved vulnerabilities were discovered by external researchers and the internet giant has handed out $38,000 in bug bounty rewards to the reporters.

Ionut Arghire

October 12, 2022

Google announced on Tuesday that the latest Chrome update patches six high-severity vulnerabilities, including four use-after-free bugs.

All the newly resolved vulnerabilities were discovered by external researchers and the internet giant has handed out $38,000 in bug bounty rewards to the reporters.

Based on the bug bounty amounts that Google has paid out, the most severe of the newly addressed flaws is CVE-2022-3445, a use-after-free vulnerability in Skia, the open-source 2D graphics library that serves as Chrome’s graphics engine.

Google says in its advisory that it has paid a $15,000 bug bounty reward to Nan Wang and Yong Liu of Qihoo 360 for reporting the issue last month.

Another $13,000, Google says, has been handed out to Kaijie Xu for reporting CVE-2022-3446, a heap buffer overflow in WebSQL.

Additionally, the internet giant paid $7,500 to Narendra Bhati of Suma Soft, who reported an inappropriate implementation in Custom Tabs (CVE-2022-3447), and $2,500 to a Kunlun Lab researcher who reported a use-after-free flaw in Permissions API (CVE-2022-3448).

Two other use-after-free vulnerabilities were resolved in Safe Browsing (CVE-2022-3449) and Peer Connection (CVE-2022-3450), but Google has yet to disclose the bug bounty amount.

Technical details on the addressed issues will not be released until the majority of Chrome users have installed the update.

The latest Chrome iteration is now rolling out to Windows, Mac, and Linux users as version 106.0.5249.119.

Google makes no mention of any of the newly addressed security defects being exploited in attacks.

Written By Ionut Arghire

Ionut Arghire is an international correspondent for SecurityWeek.

Latest News

Click to comment

Mapping Threat Intelligence to the NIST Compliance Framework Part 2

How threat intelligence is critical when justifying budget for GRC personnel, and for threat intelligence, incident response, security operations and CISO buyers.

Landon Winkelvoss

Password Dependency: How to Break the Cycle

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the password dependency cycle. But how can this be done?

Torsten George

Why CISOs Make Great Board Members

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make for successful board members.

Galina Antova

A Change in Mindset: From a Threat-based to Risk-based Approach to Security

A threat-based approach to security often focuses on a checklist to meet industry requirements but overlooked the key component of security: reducing risk.

Marie Hattar