Google this week released Chrome 56 in the stable channel, patching no less than 51 vulnerabilities in the popular browser.
Available for download for Windows, Mac and Linux as Chrome 56.0.2924.76, the new browser iteration patches 21 vulnerabilities reported by external researchers, 7 of which were assessed with a High severity rating, 8 as Medium risk, and 6 as Low severity. Google paid a total of more than $54,000 in bug bounties for these flaws.
Four of the High severity flaws, all Universal XSS issues in Blink (CVE-2017-5006, CVE-2017-5007, CVE-2017-5008, and CVE-2017-5010), were found by Mariusz Mlynski, who earned $32.337 in bug bounties for his discoveries.
The remaining flaws included an Unauthorised file access in Devtools (CVE-2017-5011), found by Khalil Zhani ($3000), an Out of bounds memory access in WebRTC (CVE-2017-5009), found by Sean Stanek and Chip Bradford ($3000), and a Heap overflow in V8 (CVE-2017-5012), found by Gergely Nagy ($5500).
The Medium severity flaws included two Address spoofing in Omnibox, discovered by Haosheng Wang and Armin Razmdjou, respectively ($2000 each), a Heap overflow in Skia, found by sweetchip ($2000), a Use after free in Renderer, credited to Wadih Matar ($2000), a UI spoofing in Blink, found by Haosheng Wang ($1000), an Uninitialised memory access in webm video, discovered by danberm ($500), and two Universal XSS issues in chrome://apps and chrome://downloads, both discovered by Rob Wu.
The Low severity vulnerabilities included a Use after free in Extensions, a Bypass of Content Security Policy in Blink, a Type confusion in metrics, two Heap overflows in FFmpeg, and an UI spoofing. Google has yet to detail the bounties paid for these flaws.
Last month, Google released Chrome 55 to resolve 36 vulnerabilities affecting the application, but also to turn off Flash in the browser. By blocking Flash content by default, Google was pushing for a safer browsing experience when using Chrome, given that Adobe’s plugin has been long considered one of the most vulnerable programs. Microsoft Edge and Mozilla’s Firefox also started blocking Flash content recently.
Related: XSS Found in Silently Installed Acrobat Chrome Extension
Related: Critical WebEx Extension Vulnerability Allows Code Execution