Chrome 72 Security Update: Fixes for CVE-2019-5754/5755/5756/5757

Key information: Announcement Date: January 29, 2019 Version Update: Chrome 72.0.3626.81 Improvements and Fixes: This version includes various fixes and improvements. See the change log for details. Security Fixes and Rewards: This update includes 58 security fixes. Below are several key fixes contributed by external researchers: - $7,500 reward ([914497]) for fixing a Critical-level CVE-2019-5754 vulnerability due to improper implementation in QUIC networking, reported by Klzgrad on December 12, 2018. - N/A reward ([906043]) for fixing a High-level CVE-2019-5782 vulnerability due to improper implementation in V8, reported by Zhao of Qihoo 360 Vulcan Team at the Tianfu Cup event on November 16, 2018. - $5,000 reward ([913296]) for fixing a High-level CVE-2019-5755 vulnerability due to improper implementation in V8, reported by Jay Bosamiya on December 10, 2018. - $5,000 reward ([895152]) for fixing a High-level CVE-2019-5756 vulnerability (use-after-free) in PDFium, reported by anonymous on October 14, 2018. - $3,000 reward ([915469]) for fixing a High-level CVE-2019-5757 vulnerability (type confusion) in SVG, reported by Alexandru Pitis, member of Microsoft’s Browser Vulnerability Research Team, on December 15, 2018. - Other medium- and low-level fixes were applied based on CVE entries listed in the Chrome 72 stable release announcement, primarily addressing insufficient policy enforcement, inadequate input validation, and memory safety issues. Acknowledgments: Google thanks all security researchers for their collaboration throughout the development cycle, helping to prevent security vulnerabilities from appearing in the stable channel.

Goal Reached Thanks to every supporter — we hit 100%!

Chrome 72 Security Update: Fixes for CVE-2019-5754/5755/5756/5757