Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Google Pays $45,000 for High-Severity Vulnerabilities Found in Chrome

Google this week announced the release of a Chrome 107 update that resolves 10 vulnerabilities, including six high-severity bugs reported by external researchers.

Google this week announced the release of a Chrome 107 update that resolves 10 vulnerabilities, including six high-severity bugs reported by external researchers.

Four of the externally reported security defects are use-after-free issues for which Google paid a total of $45,000 in bug bounty rewards to the reporting researchers.

Based on the received reward, $21,000, the most severe of these flaws is CVE-2022-3885, a use-after-free in the V8 open source JavaScript and WebAssembly engine.

Next in line is CVE-2022-3886, a vulnerability in Chrome’s speech recognition component, for which a researcher received a $10,000 bug bounty reward.

Google also patched use-after-free vulnerabilities impacting Chrome’s Web Workers and WebCodecs components and says it has paid $7,000 for each of these issues.

The two remaining Chrome 107 high-severity vulnerabilities that were reported externally include CVE-2022-3889, a type confusion in the V8 engine, and CVE-2022-3890, a heap buffer overflow in Crashpad.

Google says it has yet to determine the bug bounty amounts to be paid for the last two vulnerabilities, meaning that the total handed out to the reporting researchers might be higher than $45,000.

The internet giant makes no mention of any of these vulnerabilities being exploited in attacks.

The latest Chrome iteration is now rolling out to macOS and Linux users as version 107.0.5304.110, and to Windows users as version 107.0.5304.106/.107.

Roughly two weeks ago, Google released an emergency update to patch an actively exploited zero-day in Chrome 107.

Related: Google Releases Emergency Chrome 107 Update to Patch Actively Exploited Zero-Day

Related: Google Pays Out Over $50,000 for Vulnerabilities Patched by Chrome 107

Related: Chrome 106 Update Patches Several High-Severity Vulnerabilities

Related: Chrome 106 Patches High-Severity Vulnerabilities

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Expert Insights

Related Content

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Email Security

Microsoft is urging customers to install the latest Exchange Server updates and harden their environments to prevent malicious attacks.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Vulnerabilities

Security researchers have observed an uptick in attacks targeting CVE-2021-35394, an RCE vulnerability in Realtek Jungle SDK.

Vulnerabilities

Google has awarded more than $25,000 to the researchers who reported the vulnerabilities patched with the release of the latest Chrome update.