Security Experts:

Connect with us

Hi, what are you looking for?



Chrome 56 Patches 51 Vulnerabilities

Google this week released Chrome 56 in the stable channel, patching no less than 51 vulnerabilities in the popular browser.

Google this week released Chrome 56 in the stable channel, patching no less than 51 vulnerabilities in the popular browser.

Available for download for Windows, Mac and Linux as Chrome 56.0.2924.76, the new browser iteration patches 21 vulnerabilities reported by external researchers, 7 of which were assessed with a High severity rating, 8 as Medium risk, and 6 as Low severity. Google paid a total of more than $54,000 in bug bounties for these flaws.

Four of the High severity flaws, all Universal XSS issues in Blink (CVE-2017-5006, CVE-2017-5007, CVE-2017-5008, and CVE-2017-5010), were found by Mariusz Mlynski, who earned $32.337 in bug bounties for his discoveries.

The remaining flaws included an Unauthorised file access in Devtools (CVE-2017-5011), found by Khalil Zhani ($3000), an Out of bounds memory access in WebRTC (CVE-2017-5009), found by Sean Stanek and Chip Bradford ($3000), and a Heap overflow in V8 (CVE-2017-5012), found by Gergely Nagy ($5500).

The Medium severity flaws included two Address spoofing in Omnibox, discovered by Haosheng Wang and Armin Razmdjou, respectively ($2000 each), a Heap overflow in Skia, found by sweetchip ($2000), a Use after free in Renderer, credited to Wadih Matar ($2000), a UI spoofing in Blink, found by Haosheng Wang ($1000), an Uninitialised memory access in webm video, discovered by danberm ($500), and two Universal XSS issues in chrome://apps and chrome://downloads, both discovered by Rob Wu.

The Low severity vulnerabilities included a Use after free in Extensions, a Bypass of Content Security Policy in Blink, a Type confusion in metrics, two Heap overflows in FFmpeg, and an UI spoofing. Google has yet to detail the bounties paid for these flaws.

Last month, Google released Chrome 55 to resolve 36 vulnerabilities affecting the application, but also to turn off Flash in the browser. By blocking Flash content by default, Google was pushing for a safer browsing experience when using Chrome, given that Adobe’s plugin has been long considered one of the most vulnerable programs. Microsoft Edge and Mozilla’s Firefox also started blocking Flash content recently.

Related: XSS Found in Silently Installed Acrobat Chrome Extension

Related: Critical WebEx Extension Vulnerability Allows Code Execution

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.


Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.


Several vulnerabilities have been patched in OpenText’s enterprise content management (ECM) product.


Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.