Google patched 25 new flaws ahead of its stable Chrome 10 release and ahead of the Pwn2Own hacking contest in Vancouver, British Columbia, March 9.
Google sewed up 23 flaws in its Chrome Web browser March
8, one day before the Pwn2Own hacking contest opens at the CanSecWest security conference in Vancouver,
The search engine paid between $500 to $2,000 to
developers who detected the flaws, ranging
from low to high severity ratings.
Google rewarded some lower-severity issues for being "particularly
interesting or clever," and paid out $1,500 and $2,000 for bug reports where
the reporter worked with Chromium developers to patch the holes.
The plugs come more than a week after Google patched
19 security holes to prepare for Pwn2Own.
Google in January launched its Chromium Security Rewards
program, a controlled, crowdsourced approach to letting developers earn money
by helping Google squash bugs in the open-source operating system. The program has
since paid more than $100,000 in rewards payments.
For March 9's Pwn2Own hacking contest at CanSecWest, Chrome,
Apple's Safari 5, Microsoft's Internet Explorer 8 and Mozilla's Firefox 3.6
will all be exposed to hacking.
Google will pay the first researcher to hack Chrome $20,000.
If no one cracks Chrome March 9, Google will pay $10,000 for a hack on
March 10 or March 11. Pwn2Own sponsor HP TippingPoint will pay another
"We are excited that the Pwn2Own contest will bring
some of the top minds in the security community together to help improve
products like Google Chrome," a Google spokesperson told eWEEK. "Chrome
was built with security in mind from the beginning and we believe that many of
the security approaches we brought to Chrome help set it apart."
The Chrome patches are well-timed, coming just before the
of Chrome 10.0.648.127 on Windows, Mac and Linux.
Chrome 10 features more speed, courtesy of its refreshed
V8 "Crankshaft" engine, settings pages that open in a tab, sandboxed
Adobe Flash on Windows, and improved security with malware reporting and the default
disabling of outdated plugins.
when a plug-in is out of date and blocks it with an infobar, which
guides the user toward updating their plug-in with the latest fixes.