Google Chrome recently released a major update to its desktop version that fixes over 27 major issues reported by Chrome users.
Currently, Google Chrome is by far the largest browser. Paired with Google’s own search engine, it has become the browser of choice for everyone on desktop and mobile, easily overtaking Microsoft Edge or Apple’s Safari.
The popular browser’s bug bounty program has led to the discovery of many oversights and problems in the browser. With the latest update to stable version 104 for Windows, Mac and Linux desktops, Google has fixed more than 20 major issues. So let’s take a look at the release notes.
Google Chrome Stable Update 104 fixes major issues for Windows, Mac, and Linux desktops
The browser’s team is pleased to announce the promotion of Chrome 104 to the stable channel for Windows, Mac and Linux. Google Chrome 104 will also be promoted to Google’s new enhanced stable channel for Windows and Mac. The upcoming update will be rolled out in the coming days/weeks.
Chrome 104.0.5112.79 (Mac/Linux) and 104.0.5112.79/80/81 (Windows) contain some fixes and improvements, with a list of all changes now available in the browser’s update log. Keep an eye out for upcoming Chrome and Chromium blog posts on the new features and all the important efforts that have been made in the stable Update 104.
Security fixes and rewards
It should be noted that access to bug details and links may remain restricted by Google until the majority of users are updated with a fix. Google also maintains limitations when the bug is present in one or more third-party libraries that other projects similarly depend on but have not yet fixed.
According to the latest information, the stable update 104 contains 27 security fixes. Below are the highlighted fixes contributed by external researchers. Visit the Chrome security page for more information.
- [$15000]  High CVE-2022-2603: Use after Free in Omnibox. As reported by Anonymous on 05/16/2022
- [$10000]  High CVE-2022-2604: Use in Safe Browsing after free use. As reported by Nan Wang (@eternalsakura13) and Guang Gong of 360 Alpha Lab on 06/10/2022
- [$7000]  High CVE-2022-2605: Read out in Dawn. Reported by Looben Yang on 06/22/2022
- [$5000]  High CVE-2022-2606: Usage after Free in API for managed devices. As reported by Nan Wang (@eternalsakura13) and Guang Gong of 360 Alpha Lab on 05/31/2022
- [$3000]  High CVE-2022-2607: Use for free in Tab Strip. As reported by @ginggilBesel on 01/11/2022
- [$3000]  High CVE-2022-2608: Usage after free usage in summary mode. As reported by Khalil Zhani on 06/01/2022
- [$TBD]  High CVE-2022-2609: Use after Free in Nearby Share. As reported by koocola (@alo_cook) and Guang Gong of the 360 Vulnerability Research Institute on 06/22/2022
- [$8000]  Medium CVE-2022-2610: Insufficient policy enforcement in background fetch. As reported by Maurice Dauer on 12/09/2021
- [$5000]  Medium CVE-2022-2611: Inappropriate implementation in full screen API. As reported by Irvan Kurniawan (source7) on 04/28/2022
- [$5000]  Medium CVE-2022-2612: Side channel information loss on keyboard input. Reported by Erik Kraft (firstname.lastname@example.org), Martin Schwarzl (email@example.com) on April 30, 2022
- [$5000]  Medium CVE-2022-2613: Use after free input. Reported by Piotr Tworek (Vewd) on 05/13/2022
- [$5000]  Medium CVE-2022-2614: Use in sign-up flow after free sign-up. Reported by Rabe at the KunLun lab on 07/05/2022
- [$4000]  Medium CVE-2022-2615: Inadequate policy enforcement in cookies. As reported by Maurice Dauer on 11/10/2021
- [$3000]  Medium CVE-2022-2616: Inappropriate implementation in extension API. As reported by Alesandro Ortiz on 03/02/2022
- [$2000]  Medium CVE-2022-2617: Use after Free in Extension API. As reported by @ginggilBesel on 01/31/2022
- [$2000]  Medium CVE-2022-2618: Insufficient validation of untrusted input in Internals. As reported by asnine on 03/21/2022
- [$2000]  Medium CVE-2022-2619: Insufficient validation of untrusted input in settings. As reported by Oliver Dunk on 06/04/2022
- [$2000]  Medium CVE-2022-2620: Use after Free in WebUI. As reported by Nan Wang (@eternalsakura13) and Guang Gong of 360 Alpha Lab on 06/17/2022
- [$1000]  Medium CVE-2022-2621: Use after free in extensions. As reported by Huyna at Viettel Cyber Security on 05/07/2022
- [$1000]  Medium CVE-2022-2622: Insufficient validation of untrusted input in Safe Browsing. Reported by Imre Rad (@ImreRad) and @j00sean on 06/03/2022
- [$1000]  Medium CVE-2022-2623: Usage after Free in offline mode. As reported by Rabe at the KunLun lab on 06/20/2022
- [$TBD]  Medium CVE-2022-2624: Heap buffer overflow in PDF. As reported by YU-CHANG CHEN and CHIH-YEN CHANG in collaboration with DEVCORE internship program on 06/27/2022
Google’s own ongoing internal security work has been responsible for a variety of fixes, which are as follows:
-  Various fixes from internal audits, fuzzing and other initiatives
Many of Google Chrome’s vulnerabilities are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, LibFuzzer or AFL.