Google plugs 27 holes enroute to releasing Chrome 11 to the stable channel for Windows, Mac and Linux. Bug hunters earned $16,500 for their finds.
Google paid out a record $16,500 to developers for
plugging 27 Chrome Web browser vulnerabilities, paving the way for the launch of the Chrome 11.
, which launched to the stable channel for Windows, Mac and Linux
April 27, includes such perks as speech input translation
Chromium development community members and other
tinkerers of the open-source browser found a slew of
flaws with the latest application build.
These included 18 holes rated "high," six dubbed
"medium" and three considered "low" risk. Per policy, Google
rewarded most of them for their discoveries.
While a high-risk stale pointer in floating object
handling and a low-risk pop-up block bypass via plug-ins went unpaid, Google
paid between $500 and $3,000 for vulnerabilities such as:
Medium-risk lack of thread safety in MIME handling
High-risk corrupt node trees with mutation events
High-risk use-after-free in DOM id handling ($1,500)
High-risk dangling pointers in DOM id map ($2,000)
High-risk possible URL bar spoofs with navigation errors
and interrupted loads ($3,000)
See the full list of flaws here
. Google gave a shout-out of thanks to miaubiz, kuzzcc, Sławomir Błażek,
Drew Yao and Braden Thomas of Apple's product security team for working with the
Chrome team to ensure bugs don't reach the stable channel.
Google pays the bug hunters through its Chromium Security
Rewards program, a crowdsourced approach to letting developers earn money by
helping Google squash bugs in Chrome. Mozilla also employs a bug-hunting payment system.
The company patched a slew of flaws in March ahead of the
renowned Pwn2Own hacker contest, including
19 Feb. 28, totaling $14,000, and 25 on March 8 totaling
more than $16,000. Google paid out
another $8,500 March 24 for six bug fixes.
In total, Google has paid out more than $100,000 worth of
rewards since launching the rewards program last January. Google's own security
team spent part of March shoring up
SSL certificates in the wake of the Comodo Security hack, which
exposed digital certificates.