Find a Question:
Software Update: Google Chrome 38.0.2125.101
Google has released version 38 of its browser Chrome. Google Chrome is available for Windows, Linux and OS X. There are also versions for Android and iOS, but they follow a slightly different release schedule. In version 38, we find no major changes. The release notes mention several new apps and extension-APIs, and and changes the stability and performance should benefit. Furthermore, there will be a large number of mostly small but also fixed a few serious security problems.
Stable Channel Update
The Chrome team is delighted to announce the promotion of Chrome 38 to the stable channel for Windows, Mac and Linux. Chrome 38.0.2125.101 contains a number of fixes and improvements, including:
A number of new apps / extension APIs
Lots of under the hood changes for stability and performance
A full list of changes is available in the log .
Security Fixes and Rewards
This update includes 159 security fixes ,-including 113 Relatively minor fixes found using MemorySanitizer . Below, we highlight fixes That Were Either contributed by external researchers or particularly interesting. Please see the Chromium security page for more information.
[ 416 449 ] Critical CVE-2014-3188: A special thanks to Jüri Aedla for a combination of V8 and IPC bugs That can lead to remote code execution outside of the sandbox.
[ 398384 ] High CVE-2014-3189: Out-of-bounds read in PDFium.
[ 400476 ] High CVE-2014-3190: Use-after-free in Events.
[ 402 407 ] High CVE-2014-3191: Use-after-free in Rendering.
[ 403276 ] High CVE-2014-3192: Use-after-free in DOM.
[ 399 655 ] High CVE-2014-3193: Type confusion in Session Management.
[ 401115 ] High CVE-2014-3194: Use-after-free in Web Workers.
[ 403409 ] Medium CVE-2014-3195: Information Leak in V8.
[ 338538 ] Medium CVE-2014-3196: Permissions Bypass Windows Sandbox.
[ 396544 ] Medium CVE-2014-3197: Information Leak in XSS Auditor.
[ 415 307 ] Medium CVE-2014-3198: Out-of-bounds read in PDFium.
[ 395411 ] Low CVE-2014-3199: Release Assert in V8 bindings.
We would also like to thank Atte Kettunen of OUSPG and Collin Payne for working with us during the development cycle to preventDefault security bugs from ever reaching the stable channel. $ 23,000 in additional rewards were issued.
As usual, our ongoing internal security work Responsible for a wide range of fixes:
[ 420899 ] CVE-2014-3200: Various fixes from internal audits, fuzzing and other Initiatives (Chrome 38).
Multiple vulnerabilities in V8 fixed at the tip of the branch 3:28 (currently 18.104.22.168).
Answer this Question
You must be Logged In to post an Answer.
Not a member yet? Sign Up Now »
Star Points Scale
Earn points for Asking and Answering Questions!