Today the Chrome team has announced the release of Chrome 47 to the stable channel, the latest update to the browser on Windows, Mac and Linux. The update brings with it some 41 security fixes that range from critical to low impact. Ultimately if you are a user of the browser, you will want to get this update ASAP. It should come to you OTA but you can always force the issue by going to Settings>About in Chrome and it will go look for the update for you. For those who are curious or like to keep version score numbers at home, this build is 47.0.2526.73 m on PCs.
In all, the update addresses 1 Critical update, 13 High priority updates, 6 Medium priority updates and 3 Low priority updates. Generally speaking, severity of a security flaw is determined by number of users impact, potential data exposure and other factors.
Chrome Security Fix Listing
Unlike last month’s update to Chrome, Google has released a rundown of what was addressed in this update. The links to get more details are not currently working as they are giving a permissions error. I suspect this will be fixed as the update is rolled out to more users over the coming days. Google tends to not expose all of the issue resolved in an update until a percentage of users have updated to minimize user impact.
Google Chrome for PC
Here is the overall list:
- [$10000][558589] Critical CVE-2015-6765: Use-after-free in AppCache. Credit to anonymous.
- [$11337][551044] High CVE-2015-6766: Use-after-free in AppCache. Credit to anonymous.
- [$10000][554908] High CVE-2015-6767: Use-after-free in AppCache. Credit to anonymous.
- [$8000][556724] High CVE-2015-6768: Cross-origin bypass in DOM. Credit to Mariusz Mlynski.
- [$7500][534923] High CVE-2015-6769: Cross-origin bypass in core. Credit to Mariusz Mlynski.
- [$7500][541206] High CVE-2015-6770: Cross-origin bypass in DOM. Credit to Mariusz Mlynski.
- [$7500][544991] High CVE-2015-6771: Out of bounds access in v8. Credit to anonymous.
- [$7500][546545] High CVE-2015-6772: Cross-origin bypass in DOM. Credit to Mariusz Mlynski.
- [$7500][554946] High CVE-2015-6764: Out of bounds access in v8. Credit to Guang Gong of Qihoo 360 via pwn2own.
- [$5000][491660] High CVE-2015-6773: Out of bounds access in Skia. Credit to cloudfuzzer.
- [$5000][549251] High CVE-2015-6774: Use-after-free in Extensions. Credit to anonymous.
- [$3500][529012] High CVE-2015-6775: Type confusion in PDFium. Credit to Atte Kettunen of OUSPG.
- [$3000][457480] High CVE-2015-6776: Out of bounds access in PDFium. Credit to Hanno Böck.
- [$3000][544020] High CVE-2015-6777: Use-after-free in DOM. Credit to Long Liu of Qihoo 360Vulcan Team.
- [$2000][514891] Medium CVE-2015-6778: Out of bounds access in PDFium. Credit to Karl Skomski.
- [$2000][528505] Medium CVE-2015-6779: Scheme bypass in PDFium. Credit to Ullrich Tiljasper.
- [$1000][490492] Medium CVE-2015-6780: Use-after-free in Infobars. Credit to Khalil Zhani.
- [$1000][497302] Medium CVE-2015-6781: Integer overflow in Sfntly. Credit to miaubiz.
- [$1000][536652] Medium CVE-2015-6782: Content spoofing in Omnibox. Credit to Luan Herrera.
- [$1000][537205] Medium CVE-2015-6783: Signature validation issue in Android Crazy Linker. Credit to Michal Bednarski.
- [$500][503217] Low CVE-2015-6784: Escaping issue in saved pages. Credit to Inti De Ceukelaire.
- [$500][534542] Low CVE-2015-6785: Wildcard matching issue in CSP. Credit to mficarra@shapesecurity.com.
- [$500][534570] Low CVE-2015-6786: Scheme bypass in CSP. Credit to mficarra@shapesecurity.com.
If you are morbidly curious you can check out the Chromium security page for even more detail on all of these fixes.
