Chrome 4.0 released to address several flaws
Updated Wednesday, Jan. 27, 2010 at 11:17 a.m. EST
Google on Monday released an updated version of its Chrome web browser to address several vulnerabilities, which could allow an attacker to execute arbitrary code, according to an advisory from US-CERT issued Monday.
Chrome 4.0.249.78 for Windows addresses 13 vulnerabilities, six of which are rated “high” in severity, two rated “medium” and five rated “low,” according to Google's release notes. The vulnerabilities could also be leveraged by an attacker to obtain sensitive information, bypass security restrictions or cause a denial-of-service attack, the US-CERT said.Several of the vulnerabilities rated high in severity involve memory errors when drawing on canvases or decoding images. Other high-severity vulnerabilities involve a “cross-domain access error” and “bitmap deserialization error,” Google said.
Besides the bug fixes, the updated browser also includes support for a security feature called “Strict Transport Security,” which requires the browser to access certain websites, such as Pay Pal, using secure HTTPS connections, Google said.
"This feature strengthens the browser's defenses against attackers who control the network, such as malicious folks disrupting the wireless network at a coffee shop," Adam Barth, software engineer at Google wrote in a recent blog post.
In addition, Chrome 4 contains a new feature which helps mitigate certain cross-site scripting (XSS) attacks, called “reflective XSS protection.” The feature, described as an XSS filter, checks a script as it is about to run on a webpage to determine whether it is potentially malicious.
The updated browser also includes several other new, non-security-related features, including extensions, which allows users to customize the browser's features, and bookmark sync, which enables users to synchronize their bookmarks on multiple computers.