Google issued a new security update to fix flaws in Chrome 49
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2016-1646 | Out-of-Bounds Read in Google Chromium V8 JavaScript Engine Google's Chromium V8 JavaScript engine contains an out-of-bounds read (CWE-119), meaning the engine reads memory beyond the bounds of an allocated buffer while processing JavaScript. A remote attacker can trigger the flaw by getting a user's browser to execute crafted JavaScript, typically by luring them to a malicious or compromised web page. Successful exploitation primarily causes a denial of service (browser crash), though the advisory notes that other, unspecified impacts may also be possible. Any user of a Chromium-based browser, including Google Chrome, Microsoft Edge, and Opera, was potentially affected while running a vulnerable V8 build. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-06-08 (required action: apply updates per vendor instructions), no public proof-of-concept is known, ransomware use is unknown, and EPSS assigns a 48.1% probability of exploitation within 30 days (99th percentile). Do: Apply updates per vendor instructions: bring Google Chrome, Chromium, Opera, and any other Chromium-based browsers or V8-embedding applications up to a current vendor-supported release (this 2016 flaw is remediated in all modern builds). Because the vulnerability is on CISA's KEV list, treat patching of managed and internet-facing systems as required and verify browser/defense versions directly (e.g., via chrome://version or the application's about page) for anything still pinned to 2016-era builds. For products that bundle Chromium or V8 (kiosks, Electron-style apps, appliances), update the bundled engine rather than relying on browser-level updates. | 8.8 | 48% | KEV PoC |
| mass≈1–3 billion browser users (Chrome alone surpassed 1 billion active users around 2016 and ~3 billion more recently; V8 also ships in Chromium-based Edge and… | |
| CVE-2016-1647 +1 in the same advisory: …1648 | Use-after-free vulnerability in the RenderWidgetHostImpl::Destroy function in content/browser/renderer_host/render_widget_host_impl.cc in the Navigation impleme Use-after-free vulnerability in the RenderWidgetHostImpl::Destroy function in content/browser/renderer_host/render_widget_host_impl.cc in the Navigation implementation in Google Chrome before 49.0.2623.108 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors. NVD description · AI analysis pending | 8.8 | 2% |
| — | ||
| CVE-2016-1649 | The Program::getUniformInternal function in Program.cpp in libANGLE, as used in Google Chrome before 49.0.2623.108, does not properly handle a certain data-type The Program::getUniformInternal function in Program.cpp in libANGLE, as used in Google Chrome before 49.0.2623.108, does not properly handle a certain data-type mismatch, which allows remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via crafted shader stages. NVD description · AI analysis pending | 8.8 | 3% |
| — | ||
| CVE-2016-1650 | The PageCaptureSaveAsMHTMLFunction::ReturnFailure function in browser/extensions/api/page_capture/page_capture_api.cc in Google Chrome before 49.0.2623.108 allo The PageCaptureSaveAsMHTMLFunction::ReturnFailure function in browser/extensions/api/page_capture/page_capture_api.cc in Google Chrome before 49.0.2623.108 allows attackers to cause a denial of service or possibly have unspecified other impact by triggering an error in creating an MHTML document. NVD description · AI analysis pending | 8.8 | 1% |
| — |
Full article441 words · extracted from securityaffairs.com · click to collapse
Google has issued a new security update for its Chrome 49 that patches a number of flaws, most of them discovered by external researchers.
Google has updated Chrome 49 for all the available versions in order to patch several critical vulnerabilities, including the flaw discovered thanks its bounty program that were rewarded with dozen thousands of dollars. Since 2010, Google has been awarding hackers for discovering vulnerabilities in its products.
This isn’t the first time that the company issued an update to fix problems Chrome, the first Chrome 49 release was made available in early March to solve a total of 26 security issues. One week later GooGle released another update fixed other three high-severity vulnerabilities in the popular browser.
The new Chrome 49.0.2623.108 fix five vulnerabilities, four of which have been discovered by security experts that were awarded by the company.
The last Chrome update includes the following 4 security fixes for flaws discovered by external professionals:
- [594574] High CVE-2016-1646: Out-of-bounds read in V8. Credit to Wen Xu from Tencent KeenLab. Rewarded $7500.
- [590284] High CVE-2016-1647: Use-after-free in Navigation. Credit to anonymous. Rewarded $5500.
- [590455] High CVE-2016-1648: Use-after-free in Extensions. Credit to anonymous. Rewarded $5000
- [595836] High CVE-2016-1649: Buffer overflow in libANGLE. Credit to lokihardt working with HP’s Zero Day Initiative / Pwn2Own.
meanwhile the internal security team work fixed the following issues:
-
[597518] CVE-2016-1650: Various fixes from internal audits, fuzzing and other initiatives.
-
Multiple vulnerabilities in V8 fixed at the tip of the 4.9 branch (currently 4.9.385.33).
At the last edition of the Pwn2Own 2016 context, the researcher JungHoon Lee (aka lokihardt) failed to demonstrate a code execution exploit against Chrome, but its effort allowed the discovery of a high severity buffer overflow in libANGLE (CVE-2016-1649), for this reason, he was awarded an unspecified amount of money.
Find bugs in Chrome software is a profitable business, Google recently announced that it will pay $100,000 to anyone who can achieve a persistent compromise of a Chromebox or Chromebook in guest mode via a web page.
“Increasing our top reward from $50,000 to $100,000. Last year we introduced a $50,000 reward for the persistent compromise of a Chromebook in guest mode. Since we introduced the $50,000 reward, we haven’t had a successful submission. That said, great research deserves great awards, so we’re putting up a standing six-figure sum, available all year round with no quotas and no maximum reward pool.” states the Google Security Blog.
The company also announced the inclusion of the Download Protection Bypass in the bounty program.
“Happy hacking!”
(Security Affairs – Google, Chrome 49)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/45643/hacking/chrome-49-security-update.html