Google has released a new version of its flagship Chrome web browser with patches for a total of 19 vulnerabilities, including 16 reported by external researchers.
The most severe of these issues is CVE-2021-37981, a heap buffer overflow in Skia, for which a $20,000 bounty reward was paid, Google said in an advisory.
Next in line are CVE-2021-37982 (use-after-free issue in the Incognito component) and CVE-2021-37983 (use-after-free error in Dev Tools). Google says it awarded a $10,000 bounty reward for data on each of these flaws.
The remaining two high severity issues patched which this browser release are CVE-2021-37984 (heap buffer overflow in PDFium) and CVE-2021-37985 (use-after-free in V8), for which the Internet search giant paid $7,500 and $5,000, respectively.
Three other use-after-free vulnerabilities addressed with the release of Chrome 95 (in Network APIs, Profiles, and PDF Accessibility) feature a severity rating of medium, as do a heap buffer overflow in Settings, inappropriate implementations in Blink and WebView, a race in V8, and an out of bounds read in WebAudio.
The two low severity vulnerabilities addressed this week are two inappropriate implementation flaws in iFrame Sandbox and WebApp Installer.
Separately, Google said it improved the overall security of Chrome by removing several features, such as support for the TLS 1.0/1.1 and FTP protocols, for URLs that feature non-IPv4 hostnames ending in numbers, and for the U2F (Universal 2nd Factor) standard.
The new browser release also enforces limits on the size of cookies.
Related: Firefox 90 Drops Support for FTP Protocol
Related: Google Patches Four Severe Vulnerabilities in Chrome
Related: Chrome 94 Update Patches Actively Exploited Zero-Day Vulnerability
More from Ionut Arghire
- UAE-Linked APT Targets Middle East Government With New ‘Deadglyph’ Backdoor
- Xenomorph Android Banking Trojan Targeting Users in US, Canada
- $200 Million in Cryptocurrency Stolen in Mixin Network Hack
- Stealthy APT Gelsemium Seen Targeting Southeast Asian Government
- Nigerian Pleads Guilty in US to Million-Dollar BEC Scheme Role
- City of Dallas Details Ransomware Attack Impact, Costs
- In-the-Wild Exploitation Expected for Critical TeamCity Flaw Allowing Server Takeover
- Air Canada Says Employee Information Accessed in Cyberattack
Latest News
- Microsoft Adding New Security Features to Windows 11
- UAE-Linked APT Targets Middle East Government With New ‘Deadglyph’ Backdoor
- Sony Investigating After Hackers Offer to Sell Stolen Data
- The CISO Carousel and its Effect on Enterprise Cybersecurity
- Xenomorph Android Banking Trojan Targeting Users in US, Canada
- $200 Million in Cryptocurrency Stolen in Mixin Network Hack
- Stealthy APT Gelsemium Seen Targeting Southeast Asian Government
- Nigerian Pleads Guilty in US to Million-Dollar BEC Scheme Role
