Google reveals Chrome security patch details

Earlier today, Google was keeping mum about a three-day-old security fix to its Chrome browser, but now the company has revealed details of two critical-risk vulnerabilities and some lesser issues it says are fixed.

The critical patches relate to buffer overrun vulnerabilities that could have let a remote attacker execute arbitrary software on a Chrome user's computer, said Mark Larson, a Google Chrome program manager, in a mailing list posting Monday afternoon. The first patch fixed a vulnerability in handling long file names, called the SaveAs vulnerability, and the second a vulnerability in dealing with the Web site addresses displayed in Chrome's status area when the user hovers over a link.

An update to Google Chrome means the browser now can head off a particular technique that previously could crash the browser.

(Credit: Stephen Shankland/CNET News)

Larson also established a Google Chrome Releases blog for announcements and release notes relating to Chrome. The company had said earlier it was working on a way to release that information, in part after people requested such notes well after Google started automatically updating Chrome browsers without saying what exactly was in the update.

Google fixed two lesser security issues, too. First was an issue in which typing "about:%" in the address bar could crash the computer. The problem also meant that a Web page with that text as a hyperlink could crash the browser if a user hovered the mouse pointer over the link. Second was to prevent the user's desktop from being the default download directory to mitigate "the risk of malicious cluttering of the desktop with unwanted downloads, which can lead to executing unwanted files," Larson said.

Other fixes addressed non-security issues: a JavaScript problem with Facebook; a problem suggesting search terms while using various Web sites; and some data-transer issues with the Safe Browsing mode.

[Lerianis]

The latest updates are all well and good, but Google needs to do some more checking that sites won't be broken by the updates. Their latest updates broke the Topix site, because you cannot now click on some links on that site that were supposed to go to other pages.
And yes, I did inform Google about this.

[AppleSuxLeo]

Chrome is all rusty already. No faster than IE8 on my puter , and as a tech writer for CNN has discovered , Chrome and FF3 both hammer the CPU even after the page has loaded !, and IE8 hardly uses any CPU cycles and is within a second of Chrome in speed on real-world net use.
Chrome is dumbed-down and looks like Fisher-Price designed it.
Chrome...nothing but hype....and a security nightmare !

[pretenderkc]

LONG LIVE microsoft!!! :-)
nuff said....

[Dalkorian]

Both of you don't forget to tell the Bill that you've done his bidding and are waiting for your kickback checks. IE is the plague of the internet and should be made illegal. Period. Proprietary "standards" in a browser that's intimately tied into the OS - yeah, that sounds intelligent.

[rosoft2001]

While using Chrome I found that a lot of sites sites don't work, due to missing plugins for the new platform. Sometimes just quitting the site is not an option so I created an easy way to open the page in your "old" browser. Just drag and drop the URL from the Chrome URL bar into the Mirror form and you can continue your Chrome browsing.


Download: http://www.zonator.com/mirror.zip

[AppleSuxLeo]

"Patch" ??? This thing just coded and needs to be rushed into surgery !

[Dalkorian]

LOL - that's a good one, thanks. I'm sure you're used to releasing flawless code on day one (I'm sure you've written any code!), but most humans make mistakes.

[Rythan]

And there shall be many more patches ... it is a beta after all, not release code. Besides just how many patches have been released for the other browsers out there for security flaws??

[Camobarge]

Hmmm I thought I would give it a try and see what a "new" type of browser would have to offer.
Well its not working at all, not sure what is up with it.....
Looks like IE for me until the bugs are worked out.