bk99.de entertain the web since 1997

bk99.de
hß · SecurityCurated

Web browsers: Google Chrome and Microsoft Edge 104 close security holes

Summary

With Chrome 104 in August 2022, Google closed 27 security holes, at least seven of them high-risk; one earned its discoverer a bounty of 15,000 US dollars. Microsoft followed with Edge 104 and additionally fixed three Edge-specific bugs, including a critical sandbox escape (CVE-2022-33649, CVSS 9.6). Also new were Media Queries Level 4 and Web Bundles for faster loading.

Ideas

  • Chromium holes affect all browsers based on it.
  • Google withholds details until most users have updated.
  • The size of the bounty indicates the severity of a hole.
  • On Linux the update comes via the package manager, not via the browser.

Insights

  • A browser monoculture bundles risks across vendor boundaries.
  • Automatic updates are the most important protection, because browsers constantly acquire new holes.

Facts

  • The Chrome version was 104.0.5112.79 for Mac and Linux.
  • Edge 104 appeared as version 104.0.1293.47.

References

Critique

  • The report mixes security updates and new features, which dilutes the urgency.

Recommendations

  • Restart browsers after updates so that the new version is actually running.
  • On Linux systems, check that browser packages come from maintained sources and are updated automatically.

Read the original article

Search the Web Archive

hß · 2025

Google Chrome: critical security hole in web browser

In August 2025 Google closed a critical hole in Chrome (CVE-2025-9478), a use-after-free bug in the WebGL backend ANGLE. Attackers could exploit the memory bug via prepared websites, which usually leads to the execution of malicious code. The hole was fixed in Chrome 139.0.7258.154/155; Chromium-based browsers such as Edge are likely to be affected as well.

hß · 2006

New Linux kernels close security holes

In August 2006 new Linux kernels of the 2.4.33, 2.6.16 and 2.6.17 series appeared that closed security holes. A bug in the SCTP function sctp_make_abort_user allowed logged-in attackers to execute code with higher privileges. A UDF bug crashed the system and had not yet been fixed in 2.4.33.

hß · 2002

Microsoft plugs security holes in Office Web Components

In August 2002 Microsoft reported three critical holes in Office Web Components 2000 and 2002, which were part of Office, Money, Project and several server products. Via the Host() function, a prepared web page could start Office programs and execute arbitrary commands, and two further holes exposed the clipboard and local files. The patch was already included in Service Pack 2 for Office XP.