Google Chrome 156 Addresses 353 Vulnerabilities, Primarily Memory Corruption Flaws
Google Chrome's latest stable release, version 156, includes patches for 353 security vulnerabilities, with a strong emphasis on memory safety issues.
Google has rolled out Chrome version 156 to its stable channel, bringing with it a substantial security update that addresses 353 distinct vulnerabilities. The majority of these fixes target memory corruption issues, a persistent challenge in software development that can lead to critical security flaws.
Digging into the specifics of the update, the release notes highlight 163 memory corruption bugs and 125 use-after-free vulnerabilities. These types of memory-related defects are notorious for their potential to be exploited by attackers to gain control over a system or crash applications. Additionally, the update includes fixes for 17 out-of-bounds read vulnerabilities and 36 instances of improper input validation, further bolstering the browser's security posture.
The severity breakdown of the patched vulnerabilities indicates a focus on critical and high-impact issues. The update resolves six critical-severity vulnerabilities, five of which are memory corruption defects and one is a use-after-free bug. Furthermore, 61 high-severity security issues, 197 medium-severity flaws, and 89 low-severity weaknesses have been addressed, demonstrating a comprehensive approach to vulnerability management.
While the sheer volume of patches might suggest widespread exploitation, Google's advisory indicates that none of the vulnerabilities patched in Chrome 156 have been observed being exploited in the wild. This suggests that the update is primarily a proactive measure to secure the browser against potential future attacks.
Google's bug bounty program continues to play a significant role in identifying these vulnerabilities. Notably, no bug bounty rewards will be paid for 285 of the vulnerabilities, as they were discovered internally by Google researchers or by AI tools like OpenAI Codex Security and Anthropic's Claude. This reflects an increasing reliance on automated tools for security testing.
However, Google did acknowledge and reward researchers for 24 of the vulnerabilities, disbursing $50,000 in bug bounties. The highest single reward, $10,000, was given to Quyen Son at VinFast for a high-severity use-after-free issue discovered within Chrome's Site Isolation component. The total payout is expected to rise as details for 44 undisclosed flaws are finalized.
The latest iteration of Chrome is currently rolling out to users worldwide. It is available as versions 156.0.8078.47/.48 for Windows and macOS, and as version 156.0.8078.47 for Linux. Users are strongly encouraged to update their browsers as soon as possible to benefit from these critical security enhancements.
This extensive patch cycle underscores the ongoing battle to maintain memory safety in complex software like web browsers. As browsers become more sophisticated and handle increasingly diverse web content, the potential for memory-related vulnerabilities remains a significant concern for developers and security professionals alike.
This update to Chrome 156 significantly expands the scope of patched vulnerabilities, addressing a total of 353 flaws, a substantial increase from the 247 and 37 vulnerabilities patched in earlier October releases. Notably, six of these are classified as critical, with five involving memory corruption in components like Skia and Accessibility, and one a use-after-free bug in Accessibility. The article also highlights the emerging trend of AI tools like OpenAI Codex Security and Anthropic's Claude being credited alongside human researchers for vulnerability discovery.