The Chrome Stable channel has been updated to 17.0.963.83 on Windows, Mac, Linux and Chrome Frame.  This release fixes issues with Flash games, along with the security fixes listed below.

Security fixes and rewards:

Please see the Chromium security page for more detail. Note that the referenced bugs may be kept private until a majority of our users are up to date with the fix.

Some of the items listed below represent the start of hardening measures based on study of the exploits submitted to the Pwnium competition.

• [$1000] [113902] High CVE-2011-3050: Use-after-free with first-letter handling. Credit to miaubiz.
• [116162] High CVE-2011-3045: libpng integer issue from upstream. Credit to Glenn Randers-Pehrson of the libpng project.
• [$1000] [116461] High CVE-2011-3051: Use-after-free in CSS cross-fade handling. Credit to Arthur Gerkis.
• [116637] High CVE-2011-3052: Memory corruption in WebGL canvas handling. Credit to Ben Vanik of Google.
• [$1000] [116746] High CVE-2011-3053: Use-after-free in block splitting. Credit to miaubiz.
• [117418] Low CVE-2011-3054: Apply additional isolations to webui privileges. Credit to Sergey Glazunov.
• [117736] Low CVE-2011-3055: Prompt in the browser native UI for unpacked extension installation. Credit to PinkiePie.
• [$2000] [117550] High CVE-2011-3056: Cross-origin violation with “magic iframe”. Credit to Sergey Glazunov.

Also, this single low severity issue was fixed in a previous patch but we forgot to issue proper credit:

• [108648] Low CVE-2011-3049: Extension web request API can interfere with system requests. Credit to Michael Gundlach.

The Chrome Stable channel has been updated to 17.0.963.78 on Windows, Mac, Linux and Chrome Frame.  This release fixes issues with Flash games and videos, along with the security fix listed below.

Security fixes and rewards:

Congratulations again to community member Sergey Glazunov for the first submission to Pwnium!

• [Ch-ch-ch-ch-ching!!! $60,000] [117226] [117230] Critical CVE-2011-3046: UXSS and bad history navigation. Credit to Sergey Glazunov.

Please see the Chromium security page for more detail. Note that the referenced bugs may be kept private until a majority of our users are up to date with the fix.

The Chrome Stable channel has been updated to 17.0.963.66 on Windows, Mac, Linux and Chrome Frame.  This release fixes an issue in the DOM.  Interested in hopping on the stable channel?  Find out how.

The Chrome team is excited to announce the release of Chrome 17 to the Stable Channel for Windows, Mac, Linux and Chrome Frame.  17.0.963.46 contains a number of new features including:

• New Extensions APIs
• Updated Omnibox Prerendering
• Download Scanning Protection
• Many other small changes

Security fixes and rewards:
Please see the Chromium security page for more detail. Note that the referenced bugs may be kept private until a majority of our users are up to date with the fix

• [73478] Low CVE-2011-3953: Avoid clipboard monitoring after paste event. Credit to Daniel Cheng of the Chromium development community.
• [92550] Low CVE-2011-3954: Crash with excessive database usage. Credit to Collin Payne.
• [93106] High CVE-2011-3955: Crash aborting an IndexDB transaction. Credit to David Grogan of the Chromium development community.
• [103630] Low CVE-2011-3956: Incorrect handling of sandboxed origins inside extensions. Credit to Devdatta Akhawe, UC Berkeley.
• [$1000] [104056] High CVE-2011-3957: Use-after-free in PDF garbage collection. Credit to Aki Helin of OUSPG.
• [$2000] [105459] High CVE-2011-3958: Bad casts with column spans. Credit to miaubiz.
• [$1000] [106441] High CVE-2011-3959: Buffer overflow in locale handling. Credit to Aki Helin of OUSPG.
• [$500] [108416] Medium CVE-2011-3960: Out-of-bounds read in audio decoding. Credit to Aki Helin of OUSPG.
• [$1000] [108871] Critical CVE-2011-3961: Race condition after crash of utility process. Credit to Shawn Goertzen.
• [$500] [108901] Medium CVE-2011-3962: Out-of-bounds read in path clipping. Credit to Aki Helin of OUSPG.
• [109094] Medium CVE-2011-3963: Out-of-bounds read in PDF fax image handling. Credit to Atte Kettunen of OUSPG.
• [109245] Low CVE-2011-3964: URL bar confusion after drag + drop. Credit to Code Audit Labs of VulnHunt.com.
• [109664] Low CVE-2011-3965: Crash in signature check. Credit to Sławomir Błażek.
• [$1000] [109716] High CVE-2011-3966: Use-after-free in stylesheet error handling. Credit to Aki Helin of OUSPG.
• [109717] Low CVE-2011-3967: Crash with unusual certificate. Credit to Ben Carrillo.
• [$1000] [109743] High CVE-2011-3968: Use-after-free in CSS handling. Credit to Arthur Gerkis.
• [$1000] [110112] High CVE-2011-3969: Use-after-free in SVG layout. Credit to Arthur Gerkis.
• [$500] [110277] Medium CVE-2011-3970: Out-of-bounds read in libxslt. Credit to Aki Helin of OUSPG.
• [$1000] [110374] High CVE-2011-3971: Use-after-free with mousemove events. Credit to Arthur Gerkis.
• [110559] Medium CVE-2011-3972: Out-of-bounds read in shader translator. Credit to Google Chrome Security Team (Inferno).

The bugs [105459], [106441], [108416], [108901], [109716], [109743], [110112], [110277], [110374]  and [110559] were detected using AddressSanitizer.

In addition, we would like to thank miaubiz, Drew Yao and Braden Thomas of Apple, Sławomir Błażek, Aki Helin of OUSPG, Chamal de Silva and Atte Kettunen of OUSPG for working with us in the development cycle and preventing bugs from ever reaching the stable channel. Various rewards were issued, including a top $3133.70 reward to Aki Helin.

Now with sites pre-loading and safe browsing.

A new Google Chrome release has recently hit the streets, which can now be downloaded from the official page as version 17 (Beta).

Including various tweaks and bug fixes, Google Chrome 17 also brings two new features that will benefit both hardcore and new users.

Announced last year, a pre-load feature is now enabled by default and will load your sites before you even hit the enter button when typing URL in your address bar.

In addition to that, Google Chrome 17 will protect the everyday users by informing them on possibly malicious files that they are trying to download. This is an expanded functionality feature introduced with the Chrome 12 release.

The Chrome team is excited to announce the release of Chrome 17 to the Beta Channel.  17.0.963.26 contains a number of new features including:

• New Extensions APIs
• Updated Omnibox Prerendering
• Download Scanning Protection
• Many other small changes

The Dev channel has been updated to 17.0.963.26 for all platforms except ChromeOS. This release contains the following updates:

All

• Updated V8 - 3.7.12.12
• Make webstore installs work when the Downloads folder is missing. (Issue: 108812)

Mac

• Fixed crashes when running on top of Apple's software OpenGL renderer. (Issue: 106891)
• Fix the fullscreen exit bubble's shadow on lion. (Issue: 106798)