Google Chrome Browser

The Chrome Stable channel has been updated to 19.0.1084.52 on Windows, Mac, Linux and Chrome Frame

admin — Wed, 23 May 2012 22:15:00 +0000

The Chrome Stable channel has been updated to 19.0.1084.52 on Windows, Mac, Linux and Chrome Frame.

Security fixes and rewards:

Please see the Chromium security page for more detail. Note that the referenced bugs may be kept private until a majority of our users are up to date with the fix.

[117409] High CVE-2011-3103: Crashes in v8 garbage collection. Credit to the Chromium development community (Brett Wilson).
[118018] Medium CVE-2011-3104: Out-of-bounds read in Skia. Credit to Google Chrome Security Team (Inferno).
[$1000] [120912] High CVE-2011-3105: Use-after-free in first-letter handling. Credit to miaubiz.
[122654] Critical CVE-2011-3106: Browser memory corruption with websockets over SSL. Credit to the Chromium development community (Dharani Govindan).
[124625] High CVE-2011-3107: Crashes in the plug-in JavaScript bindings. Credit to the Chromium development community (Dharani Govindan).
[$1337] [125159] Critical CVE-2011-3108: Use-after-free in browser cache. Credit to “efbiaiinzinz”.
[Linux only] [$1000] [126296] High CVE-2011-3109: Bad cast in GTK UI. Credit to Micha Bartholomé.
[126337] [126343] [126378] [127349] [127819] [127868] High CVE-2011-3110: Out of bounds writes in PDF. Credit to Mateusz Jurczyk of the Google Security Team, with contributions by Gynvael Coldwind of the Google Security Team.
[$500] [126414] Medium CVE-2011-3111: Invalid read in v8. Credit to Christian Holler.
[127331] High CVE-2011-3112: Use-after-free with invalid encrypted PDF. Credit to Mateusz Jurczyk of the Google Security Team, with contributions by Gynvael Coldwind of the Google Security Team.
[127883] High CVE-2011-3113: Invalid cast with colorspace handling in PDF. Credit to Mateusz Jurczyk of the Google Security Team, with contributions by Gynvael Coldwind of the Google Security Team.
[128014] High CVE-2011-3114: Buffer overflows with PDF functions. Credit to Google Chrome Security Team (scarybeasts).
[$1000] [128018] High CVE-2011-3115: Type corruption in v8. Credit to Christian Holler.

Many of these bugs were detected using AddressSanitizer.

Full details about what changes are in this release are available in the SVN revision log. If you find a new issue, please let us know by filing a bug.

Anthony Laforge

Google Chrome

Download Google Chrome (Stable) 19.0.1084.52 Offline Windows Installer

The Dev channel has been updated to 20.0.1132.15 (Platform versions: 2268.23.0) for Chromebooks

admin — Wed, 23 May 2012 16:52:00 +0000

The Dev channel has been updated to 20.0.1132.15 (Platform versions: 2268.23.0) for Chromebooks (Acer AC700 , Samsung Series 5, and Cr-48).

This build contains functional & stability improvements. Some highlights of these changes are:

Improvements to trackpad on cr-48
Updates to Pepper Flash
Several crash fixes

Known issues:

Device is freezing after disconnecting external USB mouse (Issue: 31206)

If you find new issues, please let us know by visiting our help site or filing a bug. Interested in switching channels? Find out how. You can submit feedback using ‘Report an issue’ under the wrench menu.

Karen Grunberg & Danielle Drew

Google Chrome

Google Chrome, The Most Popular Web Browser In The World

admin — Wed, 23 May 2012 08:18:18 +0000

It looks like a fresh batch of the Internet Explorer TV ads and videos targeted at hipsters were not enough to accelerate the growth of Microsoft’s web browser, at least in a short term.

According to the latest report from StatCounter, Google Chrome has recently surpassed the IE and became the most popular web browser.

However, earlier this year, Microsoft has stated that they prefer HitsLink over the StatCounter, which, of course, still shows IE dominating the market with 50% vs. 17.41% respectively. Personally, we find it strange that there is such a difference between statistics.

Example:

Still, with the launch of Windows 8, Windows RT and Windows Phone 8, we expect to see the Internet Explorer trend reversing in the near feature. Do you?

[Thanks to everyone who sent this]

A Tale of Two Pwnies (Part 1)

admin — Tue, 22 May 2012 19:03:00 +0000

Just over two months ago, Chrome sponsored the Pwnium browser hacking competition. We had two fantastic submissions, and successfully blocked both exploits within 24 hours of their unveiling. Today, we’d like to offer an inside look into the exploit submitted by Pinkie Pie.

So, how does one get full remote code execution in Chrome? In the case of Pinkie Pie’s exploit, it took a chain of six different bugs in order to successfully break out of the Chrome sandbox.

Pinkie’s first bug (117620) used Chrome’s prerendering feature to load a Native Client module on a web page. Prerendering is a performance optimization that lets a site provide hints for Chrome to fetch and render a page before the user navigates to it, making page loads seem instantaneous. To avoid sound and other nuisances from preloaded pages, the prerenderer blocks plug-ins from running until the user chooses to navigate to the page. Pinkie discovered that navigating to a pre-rendered page would inadvertently run all plug-ins—even Native Client plug-ins, which are otherwise permitted only for installed extensions and apps.

Of course, getting a Native Client plug-in to execute doesn’t buy much, because the Native Client process’ sandbox is even more restrictive than Chrome’s sandbox for HTML content. What Native Client does provide, however, is a low-level interface to the GPU command buffers, which are used to communicate accelerated graphics operations to the GPU process. This allowed Pinkie to craft a special command buffer to exploit the following integer underflow bug (117656) in the GPU command decoding:

static uint32 ComputeMaxResults(size_t size_of_buffer) { return (size_of_buffer - sizeof(uint32)) / sizeof(T); }

The issue here is that if size_of_buffer is smaller than sizeof(uint32), the result would be a huge value, which was then used as input to the following function:

static size_t ComputeSize(size_t num_results) { return sizeof(T) * num_results + sizeof(uint32); }

This calculation then overflowed and made the result of this function zero, instead of a value at least equal to sizeof(uint32). Using this, Pinkie was able to write eight bytes of his choice past the end of his buffer. The buffer in this case is one of the GPU transfer buffers, which are mapped in both processes’ address spaces and used to transfer data between the Native Client and GPU processes. The Windows allocator places the buffers at relatively predictable locations; and the Native Client process can directly control their size as well as certain object allocation ordering. So, this afforded quite a bit of control over exactly where an overwrite would occur in the GPU process.

The next thing Pinkie needed was a target that met two criteria: it had to be positioned within range of his overwrite, and the first eight bytes needed to be something worth changing. For this, he used the GPU buckets, which are another IPC primitive exposed from the GPU process to the Native Client process. The buckets are implemented as a tree structure, with the first eight bytes containing pointers to other nodes in the tree. By overwriting the first eight bytes of a bucket, Pinkie was able to point it to a fake tree structure he created in one of his transfer buffers. Using that fake tree, Pinkie could read and write arbitrary addresses in the GPU process. Combined with some predictable addresses in Windows, this allowed him to build a ROP chain and execute arbitrary code inside the GPU process.

The GPU process is still sandboxed well below a normal user, but it’s not as strongly sandboxed as the Native Client process or the HTML renderer. It has some rights, such as the ability to enumerate and connect to the named pipes used by Chrome’s IPC layer. Normally this wouldn’t be an issue, but Pinkie found that there’s a brief window after Chrome spawns a new renderer where the GPU process could see the renderer’s IPC channel and connect to it first, allowing the GPU process to impersonate the renderer (bug 117627).

Even though Chrome’s renderers execute inside a stricter sandbox than the GPU process, there is a special class of renderers that have IPC interfaces with elevated permissions. These renderers are not supposed to be navigable by web content, and are used for things like extensions and settings pages. However, Pinkie found another bug (117417) that allowed an unprivileged renderer to trigger a navigation to one of these privileged renderers, and used it to launch the extension manager. So, all he had to do was jump on the extension manager’s IPC channel before it had a chance to connect.

Once he was impersonating the extensions manager, Pinkie used two more bugs to finally break out of the sandbox. The first bug (117715) allowed him to specify a load path for an extension from the extension manager’s renderer, something only the browser should be allowed to do. The second bug (117736) was a failure to prompt for confirmation prior to installing an unpacked NPAPI plug-in extension. With these two bugs Pinkie was able to install and run his own NPAPI plug-in that executed outside the sandbox at full user privilege.

So, that’s the long and impressive path Pinkie Pie took to crack Chrome. All the referenced bugs were fixed some time ago, but some are still restricted to ensure our users and Chromium embedders have a chance to update. However, we’ve included links so when we do make the bugs public, anyone can investigate in more detail.

In an upcoming post, we’ll explain the details of Sergey Glazunov’s exploit, which relied on roughly 10 distinct bugs. While these issues are already fixed in Chrome, some of them impact a much broader array of products from a range of companies. So, we won’t be posting that part until we’re comfortable that all affected products have had an adequate time to push fixes to their users.

Posted by Jorge Lucangeli Obes and Justin Schuh, Software Engineers

The Beta channel has been updated to 20.0.1132.11 for Windows, Mac, Linux, and Chrome Frame

admin — Tue, 22 May 2012 16:15:00 +0000

The Beta channel has been updated to 20.0.1132.11 for Windows, Mac, Linux, and Chrome Frame. This build contains several bug and stability fixes. Full details about what changes are in this build are available in the SVN revision log. Interested in switching release channels? Find out how. If you find a new issue, please let us know by filing a bug.

Dharani Govindan

Google Chrome

More Chrome goodness coming your way

admin — Tue, 22 May 2012 13:00:00 +0000

Today’s Chrome Beta channel release is chock full of bug fixes. Thanks to automatic updates, you can sit back, relax, and let the goodness come to you.

Posted by Dharani Govindan, Technical Program Manager

The Dev channel has been updated to 21.0.1145.0 for Windows, Mac and Linux platforms

admin — Tue, 22 May 2012 00:29:00 +0000

The Dev channel has been updated to 21.0.1145.0 for Windows, Mac and Linux platforms

All

Updated V8 - 3.11.3.0
Allow certain unused renderer processes to exit before the tab is closed. (Issue: 126333)

Fix password autofill to work again for Incognito windows (Issue: 117720)

Prevent an infinite loop inside SSLClientSocketNSS::OnSendComplete. This has been observed in Chrome OS, but could also happen on other platforms. (Issue: 127822)

Known Issues

In bookmark bubble unable to edit the name and select the sub folder from drop down (Issue: 128612)

More details about additional changes are available in the svn log of all revisions.

You can find out about getting on the Dev channel here: http://dev.chromium.org/getting-involved/dev-channel.

If you find new issues, please let us know by filing a bug at http://code.google.com/p/chromium/issues/entry

Karen Grunberg
Google Chrome

DuckDuckGo Zero-Click Info Adds Instant Answers to Google

admin — Mon, 21 May 2012 16:00:00 +0000

Chrome: One of the best features in the search engine DuckDuckGo is the instant answers shown at the top of the results page. If you find yourself more attached to Google for web searches, but want the instant answer feature, DuckDuckGo Zero-Click Info is a Chrome extension that stuffs those results right in your Google searches.More »

Google Chrome Overtakes Internet Explorer as the Number One Browser

admin — Mon, 21 May 2012 15:30:00 +0000

According to digital analytics site StatCounter, Google Chrome has passed Internet Explorer as the most popular web browser with 31.88% of the world's web traffic. Internet Explorer wasn't far behind coming in at a close second with 31.47%.More »

The Dev channel has been updated to 20.0.1132.11 (Platform versions: 2268.16.0) for Chromebooks

admin — Fri, 18 May 2012 20:54:00 +0000

The Dev channel has been updated to 20.0.1132.11 (Platform versions: 2268.16.0) for Chromebooks (Acer AC700 , Samsung Series 5, and Cr-48).

This build contains security & stability improvements. Some highlights of these changes are:

30931, 30059, 30688 - Fixed several issues around audio not playing with videos
Improvements to trackpad on Cr-48
Crash fixes

Known issues:

128592 - Sync may not be enabled for some users after the update. Workaround: Enable sync by going to the Settings menu.

Danielle Drew
Google Chrome