213 vulnerabilities fixed, seven of them critical: that is Chrome 157’s security tally, for the new stable version on Windows, macOS, and Linux. The update also shortens the process of sharing a tab from the desktop, although the most urgent change is in the patches. Google says the fixed flaws had not been exploited outside the lab; even so, their technical details are now public.
Seven critical flaws and 77 high-risk ones
The breakdown published by SoftZone includes seven critical vulnerabilities, 77 high-risk, 75 medium-risk, and 54 low-risk. Four of the seven critical flaws are use-after-free (UAF) errors, found in various Chrome components. In total, this category accounts for 45 of the 213 vulnerabilities fixed.
A UAF error occurs when a program continues to use a memory area after it has been freed. According to SoftZone, this type of flaw can potentially allow unauthorized code execution if an attacker manages to exploit it. The publication also counts 13 data leaks and 13 type confusion errors, or type mix-ups, found mainly in V8, the engine Chrome uses to process JavaScript.
The presence of errors in V8 matters because the component is involved in executing JavaScript code on web pages. SoftZone notes that problems in this engine could potentially affect pages running complex scripts. However, it does not attribute the practical exploitation of any of the flaws in this batch: according to Google, none had been exploited outside the lab.
Available versions and the source of the reports
The published builds are 157.0.8103.38 and .39 for Windows and macOS, and 157.0.8103.38 for Linux. Google announced the update in a desktop stable-channel post signed by Srinivas Sista. SoftZone dates the rollout to November 5 and describes the release as part of the browser’s regular patch cycle.
According to SoftZone’s count, Google’s security team identified 130 of the vulnerabilities. The rest were reported by external researchers; the company had paid out $31,000 in rewards by the date of publication. The researchers’ names and the amount associated with each flaw are not detailed there.
The fact that the vulnerabilities have not been exploited in practice does not remove the need to install the update. SoftZone warns that publishing technical details could make it easier to develop an exploit, and points to the number of high-risk flaws as a reason to check the installed version, even on devices that receive updates automatically.
Right-click to send tabs between devices
Chrome 157’s visible new feature is in the desktop tab context menu. Right-clicking an open tab lets you choose “Send to your devices” to send it to another computer associated with the same Google account. Previously, the process went through the three-dot menu and the “Cast, save, and share” and “Send to your devices” options.
Sending requires signing in with the same Google account on both the device sharing the tab and the one receiving it. On Android, the described gesture is different: open the tab, press and hold the address bar, and choose the option from the drop-down menu. SoftZone notes that this mobile option has been available since Chrome 77, in 2019; the addition in this version is the desktop right-click shortcut.
How to check for the update
Chrome usually installs updates in the background. To check the version, open the three-dot menu, go to “Help,” and select “About Google Chrome.” SoftZone also gives the path “Settings” and then “About Google Chrome.” If the installed version does not match the build for the operating system, the browser will search for the update and apply it when restarted.
The next version, Chrome 158, is expected in two weeks, according to SoftZone, and will arrive with another batch of security patches. In the meantime, the versions released in this update are 157.0.8103.38 or 157.0.8103.39, depending on the platform.
Sources: SoftZone, Chrome Releases
