Google Hands Over £10,000 For Chrome Fixes

Google continues to reward bug hunters after it revealed that it had paid $16,500 (£9,900) to developers for plugging 27 Chrome web browser vulnerabilities.

The move paves the way for the launch of the Chrome 11.

Chrome 11, which launched to the stable channel for Windows, Mac and Linux 27 April, includes such perks as speech input translation.

Bug Hunting

Chromium development community members and other tinkerers of the open-source browser found a slew of flaws with the latest application build.

These included 18 holes rated “high,” six dubbed “medium” and three considered “low” risk. Per policy, Google rewarded most of them for their discoveries.

While a high-risk stale pointer in floating object handling and a low-risk pop-up block bypass via plug-ins went unpaid, Google paid between $500 (£300) and $3,000 (£1,800) for vulnerabilities such as:

  • Medium-risk lack of thread safety in MIME handling ($500/£300)
  • High-risk corrupt node trees with mutation events ($1,000/£600)
  • High-risk use-after-free in DOM id handling ($1,500/£900)
  • High-risk dangling pointers in DOM id map ($2,000/£1,200)
  • High-risk possible URL bar spoofs with navigation errors and interrupted loads ($3,000/£1,800)

See the full list of flaws here. Google also thanked miaubiz, kuzzcc, Sławomir Błażek, Drew Yao and Braden Thomas of Apple’s product security team for working with the Chrome team to ensure bugs don’t reach the stable channel.

Financial Rewards

Google pays the bug hunters through its Chromium Security Rewards program, a crowdsourced approach to letting developers earn money by helping Google squash bugs in Chrome. Mozilla also employs a bug-hunting payment system.

The company patched a slew of flaws in March ahead of the renowned Pwn2Own hacker contest, including 19 on 28 February, totalling $14,000 (£8,400), and 25 on 8 March totalling more than $16,000 (£9,605). Google paid out another $8,500 (£5,100) on 24 March for six bug fixes.

In total, Google has paid out more than $100,000 (£60,000) worth of rewards since launching the rewards program last January. Google’s own security team spent part of March shoring up SSL certificates in the wake of the Comodo Security hack, which exposed digital certificates.

Clint Boulton eWEEK USA 2012. Ziff Davis Enterprise Inc. All Rights Reserved

Share
Published by
Clint Boulton eWEEK USA 2012. Ziff Davis Enterprise Inc. All Rights Reserved

Recent Posts

Malicious Online Ad Campaign Steals User Logins

'Magnat' malicious advertising campaign uncovered by Cisco Talos has been stealing login credentials and other…

23 hours ago

Waymo, Nuro Launch Robo-Delivery Services In California

Cruise starts robo-delivery service in Mountain View as Waymo plans limited trial of grocery-delivery service…

23 hours ago

NSO Spyware ‘Used To Hack US Diplomats’

Apple alerts employees of US State Department of hacking by NSO Group's controversial Pegasus spyware…

24 hours ago

Starlink Plans Services In India As SpaceX Breaks Launch Record

Starlink to apply for commercial licence to provide satellite broadband services in India, as parent…

1 day ago

Musk Tesla Share Sale Surpasses $10bn

Elon Musk's Tesla share sell-off surpasses $10 billion as it reaches into fourth consecutive week,…

1 day ago

Uber To Pay $9m Settlement Over Safety Reporting Failure

Uber agrees to pay $9 million to settle dispute with California regulators over its failure…

1 day ago