Google Chrome Plugs 25 More Flaws Ahead of Pwn2Own

Google sewed up 23 flaws in its Chrome Web browser March 8, one day before the Pwn2Own hacking contest opens at the CanSecWest security conference in Vancouver, British Columbia.

The search engine paid between $500 to $2,000 to developers who detected the flaws, ranging from low to high severity ratings.

Google rewarded some lower-severity issues for being "particularly interesting or clever," and paid out $1,500 and $2,000 for bug reports where the reporter worked with Chromium developers to patch the holes.

The plugs come more than a week after Google patched 19 security holes to prepare for Pwn2Own.

Google in January launched its Chromium Security Rewards program, a controlled, crowdsourced approach to letting developers earn money by helping Google squash bugs in the open-source operating system. The program has since paid more than $100,000 in rewards payments.

For March 9's Pwn2Own hacking contest at CanSecWest, Chrome, Apple's Safari 5, Microsoft's Internet Explorer 8 and Mozilla's Firefox 3.6 will all be exposed to hacking.

Google will pay the first researcher to hack Chrome $20,000. If no one cracks Chrome March 9, Google will pay $10,000 for a hack on March 10 or March 11. Pwn2Own sponsor HP TippingPoint will pay another $10,000.

"We are excited that the Pwn2Own contest will bring some of the top minds in the security community together to help improve products like Google Chrome," a Google spokesperson told eWEEK. "Chrome was built with security in mind from the beginning and we believe that many of the security approaches we brought to Chrome help set it apart."

The Chrome patches are well-timed, coming just before the stable release of Chrome 10.0.648.127 on Windows, Mac and Linux.

Chrome 10 features more speed, courtesy of its refreshed V8 "Crankshaft" engine, settings pages that open in a tab, sandboxed Adobe Flash on Windows, and improved security with malware reporting and the default disabling of outdated plugins.

Chrome detects when a plug-in is out of date and blocks it with an infobar, which guides the user toward updating their plug-in with the latest fixes.