High CVE-2021-30509: Out of bounds write in Tab Strip. Reported by Leecraso and Guang Gong of 360 Alpha Lab on High CVE-2021-30508: Heap buffer overflow in Media Feeds. Reported by Alison Huffman, Microsoft Browser Vulnerability Research on High CVE-2021-30507: Inappropriate implementation in Offline. High CVE-2021-30506: Incorrect security UI in Web App Installs. Please see the Chrome Security Page for more information. Below, we highlight fixes that were contributed by external researchers. Many of our security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Various fixes from internal audits, fuzzing and other initiatives We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.Īs usual, our ongoing internal security work was responsible for a wide range of fixes:

Low CVE-2021-4321: Policy bypass in Blink. Low CVE-2021-30540: Incorrect security UI in payments. Low CVE-2021-30539: Insufficient policy enforcement in content security policy. Reported by Tianze Ding of Tencent Security Xuanwu Lab on Low CVE-2021-30538: Insufficient policy enforcement in content security policy. Low CVE-2021-30537: Insufficient policy enforcement in cookies.

Low CVE-2021-30536: Out of bounds read in V8. Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research on Medium CVE-2021-30558: Insufficient policy enforcement in content security policy. Medium CVE-2021-30543: Use after free in Tab Strip. Medium CVE-2021-30542: Use after free in Tab Strip. Reported by nocma, leogan, cheneyxu of WeChat Open Platform Security Team on Medium CVE-2021-30535: Double free in ICU. Medium CVE-2021-30534: Insufficient policy enforcement in iFrameSandbox. Medium CVE-2021-30533: Insufficient policy enforcement in PopupBlocker. Medium CVE-2021-30532: Insufficient policy enforcement in Content Security Policy. Medium CVE-2021-30531: Insufficient policy enforcement in Content Security Policy. Medium CVE-2021-30530: Out of bounds memory access in WebAudio. Reported by koocola and Nan Wang of 360 Alpha Lab on Medium CVE-2021-30529: Use after free in Bookmarks. Medium CVE-2021-4322: Use after free in DevTools. Reported by Man Yue Mo of GitHub Security Lab on High CVE-2021-30528: Use after free in WebAuthentication. High CVE-2021-30527: Use after free in WebUI. High CVE-2021-30526: Out of bounds write in TabStrip. High CVE-2021-30525: Use after free in TabGroups. High CVE-2021-30524: Use after free in TabStrip. High CVE-2021-30523: Use after free in WebRTC. Reported by Piotr Bania of Cisco Talos on High CVE-2021-30522: Use after free in WebAudio. High CVE-2021-30521: Heap buffer overflow in Autofill.

We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed. Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. Watch out for upcoming Chrome and Chromium blog posts about new features and big efforts delivered in 91. 77 contains a number of fixes and improvements - a list of changes is available in the log. This will roll out over the coming days/weeks.Ĭhrome. It's always in privacy mode, so it removes cookies and clears your cache and browsing history every time you close a browsing session.The Chrome team is delighted to announce the promotion of Chrome 91 to the stable channel for Windows, Mac and Linux.

Epic - This is another privacy-focused browser built on Chromium.

It also includes an option to pay your favorite content creators in lieu of viewing ads. The selling point is that Brave removes intrusive ads and prevents sites from tracking user behavior without requiring any plugins.

Brave - This browser was developed by the co-founders of Mozilla but is based on Chromium.

Vivaldi - This Chromium-based browser is also a spiritual successor to Opera, as it was created by a former Opera CEO to add back features that had been removed from that browser.

Yandex - This is a Russian browser from the search engine of the same name, but it's based on the same Blink engine that powers Chrome, Opera, and other Chromium-based browsers.

Since 2013, it has relied on Blink, which is part of Chromium.

Opera - This browser has been around for decades, and it used to be based on its own proprietary code.

Google chrome update 2021