Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Chrome 109 Patches 17 Vulnerabilities

Google on Tuesday announced the release of Chrome 109 in the stable channel with patches for 17 vulnerabilities, including 14 bugs reported by external researchers.

Google on Tuesday announced the release of Chrome 109 in the stable channel with patches for 17 vulnerabilities, including 14 bugs reported by external researchers.

Most of the externally reported security defects are medium- and low-severity flaws, with only two of them rated ‘high severity’.

These include a use-after-free issue in Overview Mode (CVE-2023-0128), and a heap buffer overflow bug in Network Service (CVE-2023-0129). Google says it paid bug bounties of $4,000 and $2,000 for these vulnerabilities, respectively.

A total of eight medium-severity bugs were resolved with the latest browser iteration, five of which are described as inappropriate implementation flaws in Chrome components such as Fullscreen API, Iframe Sandbox, and Permission Prompts.

The remaining issues include two use-after-free vulnerabilities in Cart and a heap buffer overflow bug in Platform Apps.

Chrome 109 also patches four externally reported low-severity vulnerabilities.

Interestingly, Google notes that the highest bug bounty reward was paid out for one of the low-severity issues addressed this week, namely CVE-2023-0138, a heap buffer overflow bug in the libphonenumber component.

The researcher who identified this issue received a $8,000 reward, while the highest bug bounty for a medium-severity issue was $5,000.

Advertisement. Scroll to continue reading.

In total, Google paid out $39,000 in bug bounty rewards to the reporting researchers, but the final amount might be higher, as the company has yet to determine the reward for one of the medium-severity issues.

The latest Chrome iteration is currently rolling out as version 109.0.5414.74 for Linux, version 109.0.5414.74/.75 for Windows, and version 109.0.5414.87 for macOS.

Google made no mention about any of these vulnerabilities being exploited in malicious attacks. Last year, the internet giant patched nine zero-days in the browser.

Related: Chrome 108 Patches High-Severity Memory Safety Bugs

Related: Google Pays $45,000 for High-Severity Vulnerabilities Found in Chrome

Related: Google Pays Out Over $50,000 for Vulnerabilities Patched by Chrome 107

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Discover strategies for vendor selection, integration to minimize redundancies, and maximizing ROI from your cybersecurity investments. Gain actionable insights to ensure your stack is ready for tomorrow’s challenges.

Register

Dive into critical topics such as incident response, threat intelligence, and attack surface management. Learn how to align cyber resilience plans with business objectives to reduce potential impacts and secure your organization in an ever-evolving threat landscape.

Register

People on the Move

Cloud security firm Mitiga has appointed Charlie Thomas as Chief Executive Officer.

Cynet announced the appointment of Jason Magee as Chief Executive Officer.

Ajay Garg has joined Saviynt as Chief Development Officer.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.