ie8 fix
madison

Zero Day

Ryan Naraine, Emil Protalinski and Dancho Danchev
Home / News & Blogs / Zero Day

Google pays $7,500 for 'high-risk' Chrome browser flaws

By | November 4, 2010, 8:36am PDT

Summary: The vulnerabilities, patches with Google Chrome 7.0.517.44, affects Windows, Mac, Linux and Chrome Frame users.

Google has shelled out $7,500 to pay for the latest batch of “high-risk” vulnerabilities affecting users of its flagship Chrome web browser.

The vulnerabilities, patches with Google Chrome 7.0.517.44, affects Windows, Mac, Linux and Chrome Frame users.  The most serious could lead to remote code execution (drive-by download) attacks.

[ Study: Silent patching best for securing browsers ]

Here’s an outline of the security fixes and bounty payouts:

  • [51602] High Use-after-free in text editing. Credit to David Bloom of the Google Security Team, Google Chrome Security Team (Inferno) and Google Chrome Security Team (Cris Neckar).
  • [$1000] [55257] High Memory corruption with enormous text area. Credit to wushi of team509.

    • follow Ryan Naraine on twitter

  • [$1000] [58657] High Bad cast with the SVG use element. Credit to the kuzzcc.
  • [$1000] [58731] High Invalid memory read in XPath handling. Credit to Bui Quang Minh from Bkis (www.bkis.com).
  • [$500] [58741] High Use-after-free in text control selections. Credit to “vkouchna”.
  • [$1000] [Linux only] [59320] High Integer overflows in font handling. Credit to Aki Helin of OUSPG.
  • [$1000] [60055] High Memory corruption in libvpx. Credit to Christoph Diehl.
  • [$500] [60238] High Bad use of destroyed frame object. Credit to various developers, including “gundlach”.
  • [$500] [60327] [60769] [61255] High Type confusions with event objects. Credit to “fam.lam” and Google Chrome Security Team (Inferno).
  • [$1000] [60688] High Out-of-bounds array access in SVG handling. Credit to wushi of team509.

Google uses a silent/automatic updating utility to patch its Chrome browser.

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

More from “Zero Day”

Topics

Google Inc., Team, Flaw, Web Browser, Google Chrome, Team Management, Linux, Web Browsers, Human Capital Management, Management, Operating Systems, Software, Internet, Human Resources, Workforce Management, Ryan Naraine

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues.

Disclosure

Ryan Naraine

The most important disclosure is of my employment with Kaspersky Lab as a member of the global research and analysis team. Kaspersky Lab is a global company specializing in anti-malware and secure content management technologies. I do not own stocks or other investments in any technology company.

Biography

Ryan Naraine

Ryan Naraine is a journalist and social media enthusiast specializing in Internet and computer security issues. He is currently security evangelist at Kaspersky Lab, an anti-malware company with operations around the globe. He is taking a leadership role in developing the company's online community initiative around secure content management technologies.

Prior to joining Kaspersky Lab, Ryan was Editor-at-Large/Security at eWEEK, leading the magazine's and Web site's coverage of Internet and computer security issues and managing the popular SecurityWatch blog, covering the daily threats, vulnerabilities and IT security technologies. He also covered IT security, hacker attacks and secure content management topics for Jupiter Media's internetnetnews.com.

Ryan can be reached at naraine SHIFT 2 gmail.com. For daily updates on Ryan's activities, follow him on Twitter.

16
Comments
Add Your Opinion

Join the conversation!

Just In

RE: Google pays $7,500 for 'high-risk' Chrome browser flaws
jfreedle2@... 16th Nov 2010
See, Google knows nothing about writing software.
View in thread
0 Votes
+ -
Great work guys, but, Google should pay more!!!!!
DonnieBoy 4th Nov 2010
NT.
0 Votes
+ -
RE: Google pays $7,500 for 'high-risk' Chrome browser flaws
windozefreak 4th Nov 2010
@DonnieBoy
It would be greater work if they did not try and hide the problem and let everyone know there is a problem with their product.
0 Votes
+ -
Great business model...
jasonp@... 4th Nov 2010
and one that other software vendors should be emulating. There are two levels of compensation going on here...direct payment and public credit. I can agree with DonnieBoy that the direct payment portion could be increased, but this business model is far better than the industry standard. For those who don't know what the industry standard is, it generally consists of ignoring reports of vulnerabilities or responding with a "thanks, we'll look into that". There is almost never public credit given to someone who alerts the company of a vulnerability. Even more rare is direct compensation in the form of dollars. Far more frequent is the alerter being treated like a criminal for daring to find an exploitable vulnerability. That particular business model pretty much assures that vulnerabilities will remain "secret" until they are actively being exploited. It isn't often I find myself giving props to a software company anymore, but kudos to Google for this.
0 Votes
+ -
Yes, the ability for any researcher (or hacker) in the world to be able to
DonnieBoy Updated - 4th Nov 2010
access the code, is very powerful. With Windows, the code is widely available to the black hats, just not the good guys.

I do think that Google could pay 10x for the bugs, and it would still be a drop in the bucket for them.
0 Votes
+ -
RE: Google pays $7,500 for 'high-risk' Chrome browser flaws
Socratesfoot 4th Nov 2010
You act like Microsoft would EVER put themselves on the line like that with Internet Explorer. Could you imagine the run on the bank MS would have at even a dollar an issue. Personally, I don't see it as Google paying people to fix their issues, I see it as a guarantee you won't find any.
0 Votes
+ -
RE: Google pays $7,500 for 'high-risk' Chrome browser flaws
twaynesdomain 4th Nov 2010
@Socratesfoot You don't make sense Soc, especially your last two points in the last sentence.
0 Votes
+ -
RE: Google pays $7,500 for 'high-risk' Chrome browser flaws
CodeCurmudgeon Updated - 4th Nov 2010
The silent, automatic update on Chrome does not seem to pertain to Ubuntu, and maybe Linux in general. In Ubuntu, Chrome updates with the regular update manager. along with the kernel and 'most everything else.

I started using Chrome as soon as the Linux Beta version was released, and I haven't noticed any problems with it displaying web sites yet. Well, every once in a while something will display a bit odd, but that happened with FireFox too.
0 Votes
+ -
This is the type of "Open source eyes" thing
Michael Alan Goff 4th Nov 2010
That is actually quite effective and gives me hope. It also works on the incentive system, which is definitely what I've said is Linux's biggest issue.
0 Votes
+ -
RE: Google pays $7,500 for 'high-risk' Chrome browser flaws
windozefreak 4th Nov 2010
@goff256
Are you trying to say that Google bribes the bad to keep them from attacking their software??? Explaination in order!
0 Votes
+ -
No.
Michael Alan Goff 4th Nov 2010
I'm saying that people work best when given incentive. Right now, what incentive do most FOSS users have? They can do it out of the kindness of their hearts, because few companies pay for this sort of thing.

People work best under incentive, and this includes people finding bugs for software. Giving money for people to do it? That's a good incentive.
0 Votes
+ -
Misleading Title
Jimster480 4th Nov 2010
From the title it would seem that Google is paying $7500 per flaw/exploit. When infact its paying $500-$1000
0 Votes
+ -
RE: Google pays $7,500 for 'high-risk' Chrome browser flaws
city_zen 5th Nov 2010
@Jimster480
I absolutely agree. The title is misleading.
Unfortunately, it seems the business model of ZDNet is tying (at least part of) the writer's remuneration to the number of page views their articles get. Hence you get this kind of titles.
0 Votes
+ -
RE: Google pays $7,500 for 'high-risk' Chrome browser flaws
JOHN_TUOHY 5th Nov 2010
Better that Google pay for the exploits than the criminals... eh ???
0 Votes
+ -
RE: Google pays $7,500 for 'high-risk' Chrome browser flaws
jorjitop 5th Nov 2010
The one flaw that Chrome will never fix is Google's own spyware. That is integrated into all Google products and services. This makes Google the biggest purveyor of spyware in the world.
0 Votes
+ -
RE: Google pays $7,500 for 'high-risk' Chrome browser flaws
dirtman56@... 5th Nov 2010
Gee ... I wonder if Google could afford the $7500? (LOL)
Although I find this figure much too trivial to brag about!

I use Chrome as a secondary (backup) browser; much better than I.E. but I will retain Firefox as my main portal to the internet.
0 Votes
+ -
RE: Google pays $7,500 for 'high-risk' Chrome browser flaws
jfreedle2@... 16th Nov 2010
See, Google knows nothing about writing software.

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix
Click Here
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

Blog Roll

Blog Archive

White Papers, Webcasts, & Resources
ie8 fix
ie8 fix