Google Chrome Patches 34 Flaws Including Multiple RCE Bugs

Google has released two Chrome Stable channel security updates that together patch 34 vulnerabilities, including multiple flaws that could allow remote code execution if users are lured to malicious webpages. The first update fixed 26 issues—including three critical, 22 high-severity, and one medium-severity bugs—in components such as WebGL, WebRTC, V8, Blink, Network, WebAudio, Dawn, PDFium, ANGLE, and Extensions. Google said the most serious weaknesses involved memory corruption, including use-after-free, heap and stack buffer overflows, out-of-bounds access, integer overflows, type confusion, and insufficient validation of untrusted input.

A follow-up update addressed eight additional high-severity vulnerabilities affecting WebAudio, CSS, WebGL, Dawn, WebGPU, Fonts, and FedCM, again dominated by memory-safety bugs that could lead to browser compromise. Google shipped versions 146.0.7680.153 and 146.0.7680.154 for Windows and macOS and 146.0.7680.153 for Linux in the first release, followed by 146.0.7680.164 and 146.0.7680.165 for Windows and macOS and 146.0.7680.164 for Linux in the second. The company said many flaws were found through AddressSanitizer, MemorySanitizer, and libFuzzer, paid a $7,000 bounty for one WebAudio bug, and is withholding technical details until more users have updated to reduce the risk of exploit development.