We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message
80,259 News Articles

Google patches 12 bugs in Chrome

Update includes early fix for Flash bug

Google has patched 12 vulnerabilities in its Chrome browser, all of them rated as high-level threats by the company's security team.

The patched version of Chrome also included an update to Adobe's Flash Player, giving Google users an early fix for a critical flaw that hackers have been exploiting with rigged PDF documents. Adobe plans to release that Flash patch to users of other browsers at a later stage.

The dozen flaws fixed in Chrome 7.0.517.44 include a pair related to SVG (Scalable Vector Graphics), a collection of XML specifications for describing two-dimensional vector graphics; one in Chrome's V8 JavaScript engine; and three involving aspects of the browser's text handling.

Google paid $7,500 in bounties to eight researchers who reported 11 of the 12 bugs, the most it's awarded since mid-August when the company handed out $8,674.

As usual, Google locked down its bug tracking database to bar outsiders from picking up technical details of the vulnerabilities. The company usually unlocks access to a flaw several weeks after a patch ships, to give users time to update before the information goes public.

Other browser makers, including Mozilla, do the same.

The update to the 'stable' build - Google maintains three separate 'channels' for Chrome, ranging from stable to 'beta' to dev" - included a revamped version of Flash Player, the popular media playing plug-in.

Seven months ago, Google and Adobe struck a deal that lets the former bundle Flash Player with Chrome and upgrade the plug-in using the browser's own silent updater, This is the second time in six weeks that Chrome users received a patched Flash Player before people running rival browsers, such as Microsoft's Internet Explorer or Mozilla's Firefox.

Last week, Adobe confirmed that Flash contained a critical bug that attackers were exploiting in the wild, and promised to fix the flaw by November 9. Earlier this week, however, Adobe bumped up the release of the Flash update, saying that it had wrapped up work faster than anticipated.

Although the bug is in Flash, hackers are actually using malicious PDF documents; Adobe's Reader includes code to render Flash from within a PDF, and that code is also flawed. Adobe is planning to issue a fix for Reader and the Acrobat PDF-creation software the week of Nov. 15.

The update was the second round of Chrome security fixes since the browser jumped to version 7 late last month.

According to web metrics company Net Applications, Google's hands-off update technology - which automatically applies not only patches, but also new features - shifted the bulk of Chrome 6 users to the new Chrome 7 within days.

A week after the October 21 launch of Chrome 7, that version outnumbered its predecessor in usage share by more than seven-to-one.

Chrome 7 can be downloaded for Windows, Mac OS X and Linux from Google's website. Users already running the browser will be updated automatically.

Google also updated the 'beta' channel of Chrome to version 8.0.552.28, which adds an integrated PDF viewer plug-in to the browser.

See also: Google offers bounty to web bug hunters


IDG UK Sites

Best Christmas 2014 UK tech deals, Boxing Day 2014 UK tech deals & January sales 2015 UK tech...

IDG UK Sites

Chromebooks: ready for the prime time (but not for everybody)

IDG UK Sites

Hands-on with Sony's latest smartglasses

IDG UK Sites

The 13 most inspirational Tim Cook quotes