Google patches Chrome, sidesteps Windows kernel bug

Computerworld - Google on Monday patched five vulnerabilities in Chrome by issuing a new "stable" build of the browser.

The update to Chrome 5.0.375.125 fixed three flaws rated "high," Google's second-most-serious threat rating, as well as one pegged "medium" and another labeled as "low in Google's four-step scoring system. Danish vulnerability tracker Secunia judged the cumulative update as "highly critical" using its own ranking.

As per Google's usual practice, technical details of the vulnerabilities were hidden from public view to prevent attackers from leveraging the information before most users have upgraded.

According to a blog post by Jason Kersey of the Chrome team, Google also added what he called "workarounds" to Chrome for a pair of critical vulnerabilities not in the browser's code, but in external components or software.

Kersey did not provide any additional information on the workarounds other than to point a finger at the Windows kernel and "glibc," or the GNU C Library, a collection of C programming language files and routines that's a critical component of most Linux operating system kernels.

Details of the discussions among Chrome developers who worked on the Windows kernel and glibc workarounds were also unavailable to the public, making it unclear if Kersey's reference to a critical vulnerability in the Windows kernel was to a previously-patched bug -- Microsoft has fixed three kernel flaws so far this year, most recently in June -- or to a vulnerability that hasn't yet been made public.

Microsoft was not available for comment late Tuesday.

Several researches credited with reporting the flaws were awarded bonuses as part of Google's bug bounty program. Four bugs garnered four different researchers $500 each -- Google's standard payment for Chrome bugs -- but Marc Schoenefeld was handed $1,337 for helping Google craft the Windows kernel workaround, while Simon Berry-Byrne was paid the same amount for his assistance with the glibc workaround.

Schoenefeld is a security researcher for Red Hat, while Berry-Byrne, who also is known as "SBerry," has found and reported numerous vulnerabilities in browsers, including both Chrome and Mozilla's Firefox.

The payments of $1.337 to Schoenefeld and Berry-Byrne are likely the last for that amount: Last week Google hiked its top bounty to $3,133.

This was the second security update this month for the production version, or the most polished edition, of Chrome for Windows, Mac and Linux. Google typically patches its browser every two to four weeks.

Chrome is the world's third-most-popular browser, accounting for approximately 7.2% of the browsers in use, according to the most recent numbers from Web measurement company Net Applications.

Google Chrome can be downloaded for Windows, Mac and Linux at the company's Web site. Users running the stable build will receive the update automatically in the background.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, or subscribe to Gregg's RSS feed . His e-mail address is gkeizer@ix.netcom.com.

Read more about Security in Computerworld's Security Topic Center.