Chrome 97 update fixes 26 vulnerabilities (1 critical)

[harlan4096]

Google released a new version of its Chrome web browser to the public. The new version of the web browser, Chrome 97.0.4692.99, is a security update that addresses 26 different issues in the browser, including one rated critical. Chrome Extended Stable has been updated as well to address the issues.The Extended Stable is updated to a new milestone release every 8 weeks. It is designed for organizations and Enterprise customers mainly, but available for everyone.

Chrome 97.0.4692.99 and Chrome 96.0.4664.174 are already available. Google rolls out new versions over the course of days and weeks, using Chrome's automatic updating functionality for it.

Chrome users who want the updates early can run manual checks for updates. All it takes is to select Menu > Help > About Google Chrome to start the process. Chrome displays the current version and runs a check for updates. The browser should pick up the new version during the scan to download and install it. A restart is required to complete the process.

Blog posts on the Chrome Releases blog list all externally reported security issues that Google addressed in the Chrome update. One vulnerability, CVE-2022-0289, is rated critical, the highest severity rating.
 

[$NA][1284367] Critical CVE-2022-0289: Use after free in Safe browsing. Reported by Sergei Glazunov of Google Project Zero on 2022-01-05
[$20000],[NA][1260134][1260007] High CVE-2022-0290: Use after free in Site isolation. Reported by Brendon Tiszka and Sergei Glazunov of Google Project Zero on 2021-10-15
[$20000][1281084] High CVE-2022-0291: Inappropriate implementation in Storage. Reported by Anonymous on 2021-12-19
[$17000][1270358] High CVE-2022-0292: Inappropriate implementation in Fenced Frames. Reported by Brendon Tiszka on 2021-11-16
[$15000][1283371] High CVE-2022-0293: Use after free in Web packaging. Reported by Rong Jian and Guang Gong of 360 Alpha Lab on 2021-12-30
[$10000][1273017] High CVE-2022-0294: Inappropriate implementation in Push messaging. Reported by Rong Jian and Guang Gong of 360 Alpha Lab on 2021-11-23
[$10000][1278180] High CVE-2022-0295: Use after free in Omnibox. Reported by Weipeng Jiang (@Krace) and Guang Gong of 360 Vulnerability Research Institute on 2021-12-09
[$7000][1283375] High CVE-2022-0296: Use after free in Printing. Reported by koocola(@alo_cook) and Guang Gong of 360 Vulnerability Research Institute on 2021-12-30
[$5000][1274316] High CVE-2022-0297: Use after free in Vulkan. Reported by Cassidy Kim of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd. on 2021-11-28
[$TBD][1212957] High CVE-2022-0298: Use after free in Scheduling. Reported by Yangkang (@dnpushme) of 360 ATA on 2021-05-25
[$TBD][1275438] High CVE-2022-0300: Use after free in Text Input Method Editor. Reported by Rong Jian and Guang Gong of 360 Alpha Lab on 2021-12-01
[$NA][1276331] High CVE-2022-0301: Heap buffer overflow in DevTools. Reported by Abdulrahman Alqabandi, Microsoft Browser Vulnerability Research on 2021-12-03
[$TBD][1278613] High CVE-2022-0302: Use after free in Omnibox. Reported by Weipeng Jiang (@Krace) and Guang Gong of 360 Vulnerability Research Institute on 2021-12-10
[$TBD][1281979] High CVE-2022-0303: Race in GPU Watchdog. Reported by Yi?it Can YILMAZ (@yilmazcanyigit) on 2021-12-22
[$TBD][1282118] High CVE-2022-0304: Use after free in Bookmarks. Reported by Rong Jian and Guang Gong of 360 Alpha Lab on 2021-12-22
[$TBD][1282354] High CVE-2022-0305: Inappropriate implementation in Service Worker API. Reported by @uwu7586 on 2021-12-23
[$NA][1283198] High CVE-2022-0306: Heap buffer overflow in PDFium. Reported by Sergei Glazunov of Google Project Zero on 2021-12-29
[$2000][1281881] Medium CVE-2022-0307: Use after free in Optimization Guide. Reported by Samet Bekmezci @sametbekmezci on 2021-12-21
[$2000][1282480] Medium CVE-2022-0308: Use after free in Data Transfer. Reported by @ginggilBesel on 2021-12-24
[$TBD][1240472] Medium CVE-2022-0309: Inappropriate implementation in Autofill. Reported by Alesandro Ortiz on 2021-08-17
[$TBD][1283805] Medium CVE-2022-0310: Heap buffer overflow in Task Manager. Reported by Samet Bekmezci @sametbekmezci on 2022-01-03
[$TBD][1283807] Medium CVE-2022-0311: Heap buffer overflow in Task Manager. Reported by Samet Bekmezci @sametbekmezci on 2022-01-03

Google does not seem to be aware of attacks targeting any of the vulnerabilities, as it usually reveals if that is the case in the blog posts on the Chrome Releases blog.

You can check out the Stable and Extended Channel announcements by following the links.

Now You: when do you update your browsers?
...

Continue Reading