Chrome Plugs More Holes Ahead Of Hack Contest

Google sewed up 23 flaws in its Chrome Web browser late yesterday, hours before the opening of the Pwn2Own hacking contest at the CanSecWest security conference in Vancouver, British Columbia.

The search engine paid between $500 to $2,000 (£309 to £1,234) to developers who detected the flaws, ranging from low to high severity ratings.

Rewarding security innovation

Google rewarded some lower-severity issues for being “particularly interesting or clever,” and paid out $1,500 and $2,000 for bug reports where the reporter worked with Chromium developers to patch the holes.

The plugs come more than a week after Google patched 19 security holes to prepare for Pwn2Own.

Google in January launched its Chromium Security Rewards programme, a controlled, crowdsourced approach to letting developers earn money by helping Google squash bugs in the open-source operating system. The programme has since paid more than $100,000 (£61,714) in rewards payments.

For today’s Pwn2Own hacking contest at CanSecWest, Chrome, Apple’s Safari 5, Microsoft’s Internet Explorer 8 and Mozilla’s Firefox 3.6 will all be exposed to hacking.

Google will pay the first researcher to hack Chrome $20,000. If no one cracks Chrome 9 March, Google will pay $10,000 for a hack on 10 or 11 March. Pwn2Own sponsor HP TippingPoint will pay another $10,000.

“We are excited that the Pwn2Own contest will bring some of the top minds in the security community together to help improve products like Google Chrome,” a Google spokesperson told eWEEK. “Chrome was built with security in mind from the beginning and we believe that many of the security approaches we brought to Chrome help set it apart.”

Refreshed browser release

The Chrome patches are well-timed, coming just before the stable release of Chrome 10.0.648.127 on Windows, Mac and Linux.

Chrome 10 features more speed, courtesy of its refreshed V8 “Crankshaft” engine, settings pages that open in a tab, sandboxed Adobe Flash on Windows, and improved security with malware reporting and the default disabling of outdated plugins.