Google has released a new version of its flagship Chrome web browser with patches for a total of 19 vulnerabilities, including 16 reported by external researchers.
The most severe of these issues is CVE-2021-37981, a heap buffer overflow in Skia, for which a $20,000 bounty reward was paid, Google said in an advisory.
Next in line are CVE-2021-37982 (use-after-free issue in the Incognito component) and CVE-2021-37983 (use-after-free error in Dev Tools). Google says it awarded a $10,000 bounty reward for data on each of these flaws.
The remaining two high severity issues patched which this browser release are CVE-2021-37984 (heap buffer overflow in PDFium) and CVE-2021-37985 (use-after-free in V8), for which the Internet search giant paid $7,500 and $5,000, respectively.
Three other use-after-free vulnerabilities addressed with the release of Chrome 95 (in Network APIs, Profiles, and PDF Accessibility) feature a severity rating of medium, as do a heap buffer overflow in Settings, inappropriate implementations in Blink and WebView, a race in V8, and an out of bounds read in WebAudio.
The two low severity vulnerabilities addressed this week are two inappropriate implementation flaws in iFrame Sandbox and WebApp Installer.
Separately, Google said it improved the overall security of Chrome by removing several features, such as support for the TLS 1.0/1.1 and FTP protocols, for URLs that feature non-IPv4 hostnames ending in numbers, and for the U2F (Universal 2nd Factor) standard.
The new browser release also enforces limits on the size of cookies.
Related: Firefox 90 Drops Support for FTP Protocol
Related: Google Patches Four Severe Vulnerabilities in Chrome
Related: Chrome 94 Update Patches Actively Exploited Zero-Day Vulnerability
