Google on Tuesday announced the release of Chrome 91 to the stable channel. The latest update patches a total of 32 vulnerabilities.
Of the addressed issues, 21 vulnerabilities were discovered by external researchers, including 8 high-severity bugs, 8 medium-severity flaws, and 5 low-severity security holes.
The most important of these is CVE-2021-30521, a heap buffer overflow in Autofill, for which Google paid a $20,000 bounty reward to the reporting researcher.
The new browser release also includes patches for six high-severity use-after-free flaws in WebAudio, WebRTC, TabStrip, TabGroups, WebUI, and WebAuthentication. The eighth high-risk security bug is an out-of-bounds write in TabStrip.
Four of the eight medium-severity issues addressed with this Chrome update are insufficient policy enforcements. The other four include use-after-free, out-of-bounds memory access, double-free and insufficient data validation bugs.
Google also patched low-severity out-of-bounds read, insufficient policy enforcements, and incorrect security UI vulnerabilities.
What’s interesting to note is that the Internet giant claims to have paid a $15,000 bug bounty for the low-severity out-of-bounds read issue, which affects the V8 JavaScript engine and is tracked as CVE-2021-30536.
Over the past couple of months, however, two serious bugs in V8 were made public. For one, a proof-of-concept (PoC) exploit was published before patches arrived, while the other was addressed in April.
As usual, Google has not provided full details on the security holes that the new browser release has addressed, but instead is waiting for the update to roll out to the majority of users before publishing such information.
The browser update is currently rolling out to Windows, Mac, and Linux users as Chrome 91.0.4472.77.
Related: Chrome 89 Patches Actively Exploited Vulnerability
Related: Google Chrome Zero-Day Under Attack, Again
Related: Google Patches 19 Vulnerabilities With Chrome 90 Update
