Google quashes 12 Chrome bugs, gives users early Flash fix

IE, Firefox, Safari users don't get Flash Player update until later today

Google today patched 12 vulnerabilities in its Chrome browser, all of them rated as high-level threats by the company's security team.

The patched version of Chrome also included an update to Adobe's Flash Player, giving Google users an early fix for a critical flaw that hackers have been exploiting with rigged PDF documents. Adobe plans to release that Flash patch to users of other browsers later today.

The dozen flaws fixed today in Chrome 7.0.517.44 include a pair related to SVG (Scalable Vector Graphics), a collection of XML specifications for describing two-dimensional vector graphics; one in Chrome's V8 JavaScript engine; and three involving aspects of the browser's text handling.

Google paid $7,500 in bounties to eight researchers who reported 11 of the 12 bugs, the most it's awarded since mid-August when the company handed out $8,674.

As usual, Google locked down its bug tracking database to bar outsiders from picking up technical details of the vulnerabilities. The company usually unlocks access to a flaw several weeks after a patch ships, to give users time to update before the information goes public.

Other browser makers, including Mozilla, do the same.

Today's update to the "stable" build -- Google maintains three separate "channels" for Chrome, ranging from stable to "beta" to "dev" -- included a revamped version of Flash Player, the popular media playing plug-in.

Seven months ago, Google and Adobe struck a deal that lets the former bundle Flash Player with Chrome and upgrade the plug-in using the browser's own silent updater, This is the second time in six weeks that Chrome users received a patched Flash Player before people running rival browsers, such as Microsoft's Internet Explorer or Mozilla's Firefox.

Last week, Adobe confirmed that Flash contained a critical bug that attackers were exploiting in the wild, and promised to fix the flaw by Nov. 9. Earlier this week, however, Adobe bumped up the release of the Flash update to today, saying that it had wrapped up work faster than anticipated.

Although the bug is in Flash, hackers are actually using malicious PDF documents; Adobe's Reader includes code to render Flash from within a PDF, and that code is also flawed. Adobe is planning to issue a fix for Reader and the Acrobat PDF-creation software the week of Nov. 15.

Thursday's update was the second round of Chrome security fixes since the browser jumped to version 7 late last month.

According to Web metrics company Net Applications, Google's hands-off update technology -- which automatically applies not only patches, but also new features -- shifted the bulk of Chrome 6 users to the new Chrome 7 within days.

A week after the Oct. 21 launch of Chrome 7, that version outnumbered its predecessor in usage share by more than 7-to-1.

Chrome 7 can be downloaded for Windows, Mac OS X and Linux from Google's Web site. Users already running the browser will be updated automatically.

Also today, Google updated the "beta" channel of Chrome to version 8.0.552.28, which adds an integrated PDF viewer plug-in to the browser.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags applicationsGooglesecuritybrowserssoftwareinternetmozilla

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld (US)
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?