Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Application Security

Google Patches 19 Vulnerabilities in Chrome 95 Browser Refresh

Google has released a new version of its flagship Chrome web browser with patches for a total of 19 vulnerabilities, including 16 reported by external researchers.

Google has released a new version of its flagship Chrome web browser with patches for a total of 19 vulnerabilities, including 16 reported by external researchers.

The most severe of these issues is CVE-2021-37981, a heap buffer overflow in Skia, for which a $20,000 bounty reward was paid, Google said in an advisory.

Next in line are CVE-2021-37982 (use-after-free issue in the Incognito component) and CVE-2021-37983 (use-after-free error in Dev Tools). Google says it awarded a $10,000 bounty reward for data on each of these flaws.

The remaining two high severity issues patched which this browser release are CVE-2021-37984 (heap buffer overflow in PDFium) and CVE-2021-37985 (use-after-free in V8), for which the Internet search giant paid $7,500 and $5,000, respectively.

Three other use-after-free vulnerabilities addressed with the release of Chrome 95 (in Network APIs, Profiles, and PDF Accessibility) feature a severity rating of medium, as do a heap buffer overflow in Settings, inappropriate implementations in Blink and WebView, a race in V8, and an out of bounds read in WebAudio.

The two low severity vulnerabilities addressed this week are two inappropriate implementation flaws in iFrame Sandbox and WebApp Installer.

Separately, Google said it improved the overall security of Chrome by removing several features, such as support for the TLS 1.0/1.1 and FTP protocols, for URLs that feature non-IPv4 hostnames ending in numbers, and for the U2F (Universal 2nd Factor) standard.

The new browser release also enforces limits on the size of cookies.

Related: Firefox 90 Drops Support for FTP Protocol

Related: Google Patches Four Severe Vulnerabilities in Chrome

Related: Chrome 94 Update Patches Actively Exploited Zero-Day Vulnerability

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Expert Insights

Related Content

Application Security

Cycode, a startup that provides solutions for protecting software source code, emerged from stealth mode on Tuesday with $4.6 million in seed funding.

Network Security

NSA publishes guidance to help system administrators identify and mitigate cyber risks associated with transitioning to IPv6.

Cyberwarfare

Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

Nation-State

The North Korean APT tracked as TA444 is either moonlighting from its previous primary purpose, expanding its attack repertoire, or is being impersonated by...

Malware & Threats

Microsoft plans to improve the protection of Office users by blocking XLL add-ins from the internet.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Identity & Access

Hackers rarely hack in anymore. They log in using stolen, weak, default, or otherwise compromised credentials. That’s why it’s so critical to break the...

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.