Google has fixed seven security flaws in Chrome, just a day before the annual, real-time hacking competitions Pwnium and Pwn2Own.
The new security update for Chrome on Windows, Mac, and Linux patched four flaws labeled as High, below the more important level of Critical; three flaws in its rendering engine V8; and updated its internal version of Flash Player.
Three High-level vulnerabilities were found by three independent researchers, who earned a total of $8,000 for their work. The last High-level vulnerability was discovered by Google employees, as were the V8 vulnerabilities.
[$4000][344881] High CVE-2014-1700: Use-after-free in speech. Credit to Chamal de Silva. [$3000][342618] High CVE-2014-1701: UXSS in events. Credit to aidanhs. [$1000][333058] High CVE-2014-1702: Use-after-free in web database. Credit to Collin Payne. [338354] High CVE-2014-1703: Potential sandbox escape due to a use-after-free in web sockets. [328202, 349079, 345715] CVE-2014-1704: Multiple vulnerabilities in V8 fixed in version 3.23.17.18.
Google did not immediately respond to a request for comment, although Google does issue security updates for Chrome on a regular basis.
