Google pays record bounty for Chrome bug
Patches 16 browser bugs, including one that earns researcher $3,133
Computerworld - Google patched 16 vulnerabilities in Chrome on Thursday, and it paid one researcher a record $3,133 for reporting a single bug.
The flaws fixed in Chrome 8.0.552.334 were in several components, including the browser's support for extensions, its built-in PDF viewer, and the way it processes cascading style sheets (CSS).
Thirteen of the bugs were labeled as "high" threats, Google's second-most-serious rating, and two were pegged "medium." Only one was tagged as "critical," the company's highest threat rating.
As it always does, Google locked its bug tracking database to bar outsiders from reading the technical details of the just-patched vulnerabilities. The company usually opens access to a flaw later -- sometimes within weeks, often only after months -- to give users time to update before the information goes public.
Researcher Sergey Glazunov was credited with reporting the single critical vulnerability, described by Google as a "stale pointer in speech handling." A "stale pointer" is a bug in an application's memory allocation code.
Glazunov was the first researcher to take home Google's biggest bounty.
"We're delighted to offer our first 'elite' $3133.70 Chromium Security Reward to Sergey Glazunov," said Jason Kersey, a Chrome program manager, in a post to Google's Chrome release blog.
Last July, Google raised its top dollar payout for bug discoveries from $1,337 to $3,133, making the move less than a week after rival Mozilla boosted Firefox bug bounties to $3,000.
Wednesday was also the first time that Google has classified a bug as critical since the debut of the higher bounty; only critical vulnerabilities are eligible for the $3,133 reward.
Altogether, Google paid Glazunov $7,470 for reporting five of the 16 flaws. Google wrote checks totaling more than $14,000 to Glazunov and others for their work.
Yesterday's patch collection was the third since Google updated the stable edition of Chrome to Version 8 in early December.
According to the newest statistics from Internet metrics company Net Applications, Chrome accounted for a record 10% of browsers in use last month.
Chrome 8 can be downloaded for Windows, Mac OS X and Linux from Google's Web site. Users already running the browser will be updated automatically.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, or subscribe to Gregg's RSS feed . His e-mail address is firstname.lastname@example.org.
Read more about Desktop Apps in Computerworld's Desktop Apps Topic Center.
- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- HP HAVEn: See the big picture in Big Data HP HAVEn is the industry's first comprehensive, scalable, open, and secure platform for Big Data. Enterprises are drowning in a sea of data...
- What Datapipe customers need to know about the new PCI DSS 3.0 compliance standard This handy quick reference outlines what PCI DSS 3.0 is, who needs to be compliant and how Alert Logic solutions address the new...
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Meg Whitman presents Unlocking IT with Big Data During this Web Event you will hear Meg Whitman, President and CEO, HP discuss HAVEn - the #1 Big Data platform, as well...
- The New Way to Work Knowledge Vault This Knowledge Vault focuses on how, in today's increasingly virtual world, it's more important than ever to engage deeply with employees, suppliers, partners,... All Desktop Apps White Papers | Webcasts