Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical
The browser update resolves dozens of memory safety bugs and incorrect/missing authorization issues.
Google has promoted Chrome 157 to the stable channel with patches for 213 vulnerabilities, including seven critical memory safety bugs.
At the top of the list is a buffer overflow issue in Dawn, the open source and cross-platform implementation of the WebGPU standard. It earned the reporting researcher a $10,000 reward.
The second is a memory corruption in the open source graphics engine abstraction layer ANGLE that was awarded a $1,000 bug bounty.
No rewards were listed for the remaining five critical flaws (four use-after-free defects and a buffer overflow). Google reported two of them, Anthropic’s Xinyang Ge reported two, and researcher Wenbin Liu reported the fifth.
Chrome 157 also fixes 77 high-severity vulnerabilities, including more than a dozen reported by external researchers. However, Google has disclosed only the bounties paid for two of them, namely $10,000 for an incorrect authorization, and $2,000 for an out-of-bounds read.
Per Google’s advisory, the company handed out $31,000 in rewards to the reporting researchers, but it has not determined the bug bounties to be paid for 39 of the flaws.
The most common types of vulnerabilities the fresh browser update resolves include incorrect/missing authorization (51), use-after-free (45), UI misrepresentation (19), type confusion (13), information leak (13), out-of-bounds read/write (11), improper input validation (9), and uninitialized resource (9).
Google makes no mention of any of these security defects being exploited in the wild, but users should update their browsers as soon as possible.
The latest Chrome iteration is now rolling out as versions 157.0.8103.38/.39 for Windows and macOS, and as version 157.0.8103.38 for Linux.
