by
The Chrome team announced the promotion of Chrome 99 to the stable channel for Windows, Mac and Linux on March 1, 2022. This will roll out over the coming days/weeks.
In the desktop version, a total of 28 vulnerabilities were closed. Of these, 11 were classified as high, 15 as medium and two as low. Below we will discuss a few of those vulnerabilities as far as there are details available.
The Chrome versions for iOS and Android were also updated, to 99.0.4844.47 and 99.0.4844.48 respectively. These updates are stability and performance improvements.
Vulnerabilities
Publicly disclosed computer security flaws are listed in the Common Vulnerabilities and Exposures (CVE) database. Its goal is to make it easier to share data across separate vulnerability capabilities (tools, databases, and services). All the vulnerabilities discussed below were classified as high and found by external researchers.
CVE-2022-0789: Heap buffer overflow in ANGLE. ANGLE is used as the default WebGL backend for both Google Chrome and Mozilla Firefox on Windows platforms. Heap is the name for a region of a process’ memory which is used to store dynamic variables. A buffer overflow is a type of software vulnerability that exists when an area of memory within a software application reaches its address boundary and writes into an adjacent memory region. In software exploit code, the two common areas that are targeted for overflows are the stack and the heap.
CVE-2022-0790: Use after free in Cast UI. Use after free (UAF) is a vulnerability due to incorrect use of dynamic memory during a program’s operation. If after freeing a memory location, a program does not clear the pointer to that memory, an attacker can use the error to manipulate the program. The Cast UI is the menu that allows you to cast a browser tab to an external screen, e.g. via Chromecast.
CVE-2022-0791: Use after free in Omnibox. The Omnibox is the Google Chrome address bar which is called Omnibox because it can be used for many other functions besides surfing to a web address.
CVE-2022-0792: Out of bounds read in ANGLE. An out of bounds read vulnerability means that the program reads data from outside the bounds of allocated memory. Potentially this type of vulnerability could be used to exfiltrate data from the affected machine.
CVE-2022-0793: Use after free in Views. Views is the framework that allows Chrome developers to build a custom user interface for use on the Windows platform.
CVE-2022-0794: Use after free in WebShare. Web Share is an API for sharing data (text, URLs, images) from the web to an app of the user’s choosing. A user can share current tab and selected text using the installed apps on their computer.
CVE-2022-0795: Type Confusion in Blink Layout. A type confusion vulnerability exists when a piece of code doesn’t verify the type of object that is passed to it. In some cases of type confusion, wrong function pointers or data are fed into the wrong piece of code. Under some circumstances this can lead to code execution. Blink is an open-source browser layout engine developed by Google as part of the Chromium Project and part of the Chrome browser.
CVE-2022-0796: Use after free in Media. The Media component is used to display many media types in the browser.
CVE-2022-0797: Out of bounds memory access in Mojo. Mojo is a platform for sandboxed services communicating over IPC. Inter-process Communication (IPC) is the component that was designed to regulate communication between the processes in Chrome’s multi-process architecture.
As more details about the vulnerabilities will be released once everyone has had a chance to install the latest version, we will keep you posted on any important additional information.
How to update
The easiest way to update Chrome is to allow it to update automatically, which basically uses the same method as outlined below but does not require your attention. However, you can end up lagging behind if you never close the browser or if something goes wrong, such as an extension stopping you from updating the browser.
So, it doesn’t hurt to check now and then. And now would be a good time, given the severity of the vulnerability. My preferred method is to have Chrome open the page chrome://settings/help which you can also find by clicking Settings > About Chrome.
If there is an update available, Chrome will notify you and start downloading it. Then all you have to do is relaunch the browser in order for the update to complete.
Nearing 100
The desktop version has now been updated to the new version 99 (99.0.4844.51), which means we are one step closer to the potential problems with user agent strings that may arise when we reach major version 100. This is currently slated for released on March 29.
