Chrome Releases
Release updates from the Chrome team
Stable Channel Update for Desktop
Tuesday, September 10, 2019
The Chrome team is delighted to announce the promotion of Chrome 77 to the Stable channel for Windows, Mac and Linux. This will roll out over the coming days/weeks
.
Chrome 77.0.3865.75 contains a number of fixes and improvements -- a full list of changes in this build is available in the
l
og
. Watch out for upcoming
Chrome
and
Chromium
blog posts about new features and big efforts delivered in Chrome 77.
Security Fixes and Rewards
Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.
This update includes
54
security fixes. Below, we highlight fixes that were contributed by external researchers. Please see the
Chrome Security Page
for more information.
[$30000][
999311
]
Critical
CVE-2019-5870: Use-after-free in media.
Reported by Guang Gong of Alpha Team, Qihoo 360 on 2019-08-29
[$10000][
989969
]
Critical
CVE-2019-13766: Use-after-free in accessibility.
Reported by Pawel Wylecial of REDTEAM.PL on 2019-08-01
[$7500][
990570
]
High
CVE-2019-5871: Heap overflow in Skia.
Reported by Anonymous on 2019-08-03
[$3000][
981492
]
High
CVE-2019-5872: Use-after-free in Mojo.
Reported by Zhe Jin(金哲),Luyao Liu(刘路遥) from Chengdu Security Response
Center of Qihoo 360 Technology Co. Ltd on 2019-07-05
[$3000][
989497
]
High
CVE-2019-5873: URL bar spoofing on iOS.
Reported by Khalil Zhani on 2019-07-31
[$3000][
989797
]
High
CVE-2019-5874: External URIs may trigger other browsers.
Reported by James Lee (@Windowsrcer) on 2019-08-01
[$2000][
979443
]
High
CVE-2019-5875: URL bar spoof via download redirect.
Reported by Khalil Zhani on 2019-06-28
[$3000][
966914
]
High
CVE-2019-13691: Omnibox spoof.
Reported by David Erceg on 2019-05-24
[$5000][
991888
]
High
CVE-2019-13692: SOP bypass.
Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research on 2019-08-08
[$20000][
997190
]
High
CVE-2019-5876: Use-after-free in media.
Reported by Man Yue Mo of Semmle Security Research Team on 2019-08-23
[$10000][
999310
]
High
CVE-2019-5877: Out-of-bounds access in V8.
Reported by Guang Gong of Alpha Team, Qihoo 360 on 2019-08-29
[$N/A][
1000217
]
High
CVE-2019-5878: Use-after-free in V8.
Reported by Guang Gong of Alpha Team, Qihoo 360 on 2019-09-03
[$3000][
986043
]
Medium
CVE-2019-5879: Extensions can read some local files.
Reported by Jinseo Kim on 2019-07-20
[$2000][
831725
]
Medium
CVE-2019-5880: SameSite cookie bypass.
Reported by Jun Kokatsu (@shhnjk) on 2018-04-11
[$2000][
980816
]
Medium
CVE-2019-5881: Arbitrary read in SwiftShader.
Reported by Zhe Jin(金哲),Luyao Liu(刘路遥) from Chengdu Security Response
Center of Qihoo 360 Technology Co. Ltd on 2019-07-03
[$2000][
803365
]
Medium
CVE-2019-5880: Insufficient policy enforcement in cookies.
Reported by Isaac Dawson on 2018-01-18
[$2000][
7
09946
]
Medium
CVE-2019-5880: Insufficient policy enforcement in cookies.
Reported by Gertjan Franken on 2017-04-10
[$1000][
868846
]
Medium
CVE-2019-13659: URL spoof.
Reported by Lnyas Zhang on 2018-07-30
[$1000][
882363
]
Medium
CVE-2019-13660: Full screen notification overlap.
Reported by Wenxu Wu (@ma7h1as) of Tencent Security Xuanwu Lab on 2018-09-10
[$1000][
882812
]
Medium
CVE-2019-13661: Full screen notification spoof.
Reported by Wenxu Wu (@ma7h1as) of Tencent Security Xuanwu Lab on 2018-09-11
[$1000][
967780
]
Medium
CVE-2019-13662: CSP bypass.
Reported by David Erceg on 2019-05-28
[$500][
863661
]
Medium
CVE-2019-13663: IDN spoof.
Reported by Lnyas Zhang on 2018-07-14
[$1000][
40094752
]
Medium
CVE-2019-25154: Inappropriate implementation in iframe.
Reported by David Erceg on 2019-04-26
[$500][
915538
]
Medium
CVE-2019-13664: CSRF bypass.
Reported by thomas "zemnmez" shadwell on 2018-12-16
[$500][
959640
]
Medium
CVE-2019-13665: Multiple file download protection bypass.
Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research on 2019-05-05
[$500][
960305
]
Medium
CVE-2019-13666: Side channel using storage size estimate.
Reported by Tom Van Goethem from imec-DistriNet, KU Leuven on 2019-05-07
[$500][
973056
]
Medium
CVE-2019-13667: URI bar spoof when using external app URIs.
Reported by Khalil Zhani on 2019-06-11
[$500][
986393
]
Medium
CVE-2019-13668: Global window leak via console.
Reported by David Erceg on 2019-07-22
[$N/A][
968451
]
Medium
CVE-2019-13669: HTTP authentication spoof.
Reported by Khalil Zhani on 2019-05-30
[$N/A][
980891
]
Medium
CVE-2019-13670: V8 memory corruption in regex.
Reported by Guang Gong of Alpha Team, Qihoo 360 on 2019-07-03
[$1000][
696454
]
Medium
CVE-2019-13671: Dialog box fails to show origin.
Reported by xisigr of Tencent's Xuanwu Lab on 2017-02-27
[$500][
997925
]
Medium
CVE-2019-13673: Cross-origin information leak using devtools.
Reported by David Erceg on 2019-08-26
[$500][
896533
]
Low
CVE-2019-13674: IDN spoofing.
Reported by Khalil Zhani on 2018-10-18
[$500][
929578
]
Low
CVE-2019-13675: Extensions can be disabled by trailing slash.
Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research on 2019-02-07
[$N/A][
875178
]
Low
CVE-2019-13676: Google URI shown for certificate warning.
Reported by Wenxu Wu (@ma7h1as) of Tencent Security Xuanwu Lab on 2018-08-17
[$500][
939108
]
Low
CVE-2019-13677: Chrome web store origin needs to be isolated.
Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research on 2019-03-06
[$500][
946633
]
Low
CVE-2019-13678: Download dialog spoofing.
Reported by Ronni Skansing on 2019-03-27
[$N/A][
968914
]
Low
CVE-2019-13679: User gesture needed for printing.
Reported by Conrad Irwin, Superhuman on 2019-05-31
[$500][
969684
]
Low
CVE-2019-13680: IP address spoofing to servers.
Reported by Thijs Alkemade from Computest on 2019-06-03
[$500][
970378
]
Low
CVE-2019-13681: Bypass on download restrictions.
Reported by David Erceg on 2019-06-04
[$3000][
971917
]
Low
CVE-2019-13682: Site isolation bypass.
Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research on 2019-06-07
[$N/A][
987502
]
Low
CVE-2019-13683: Exceptions leaked by devtools.
Reported by David Erceg on 2019-07-25
We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.
As usual, our ongoing internal security work was responsible for a wide range of fixes:
[
1002279
]
Various fixes from internal audits, fuzzing and other initiatives
Many of our security bugs are detected using
AddressSanitizer
,
MemorySanitizer
,
UndefinedBehaviorSanitizer
,
Control Flow Integrity
,
libFuzzer
, or
AFL
.
Interested in switching release channels? Find out how
here
. If you find a new issue, please let us know by
filing a bug
.
The
community help forum
is also a great place to reach out for help or learn about common issues.
Lakshmana Pamarthy
Google Chrome
Labels
Admin Console
43
Android WebView
19
Beta
21
Beta update
4
Beta updates
1970
chrome
15
Chrome Dev for Android
116
Chrome for Android
905
Chrome for iOS
355
Chrome for Meetings
5
Chrome OS
1149
Chrome OS Flex
22
Chrome OS Management
12
Chromecast Update
6
ChromeOS
174
ChromeOS Flex
173
Desktop Update
1062
dev update
265
Dev updates
1475
Early Stable Updates
43
Extended Stable updates
116
Flash Player update
5
Hangouts Meet hardware
5
LTS
79
stable
9
Stable updates
1194
Archive
2024
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2023
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2022
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2021
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2020
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2019
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2018
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2017
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2016
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2015
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2014
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2013
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2012
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2011
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2010
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2009
Dec
Nov
Oct
Sep
Aug
Jul
Jun
May
Apr
Mar
Feb
Jan
2008
Dec
Nov
Oct
Sep
Give us feedback in our
Product Forums
.