Google Hands Over £10,000 For Chrome Fixes

Clint Boulton eWEEK USA 2012. Ziff Davis Enterprise Inc. All Rights Reserved,

Google has patched 27 security holes in Chrome and rewarded bug hunters with just under £10,000

Google continues to reward bug hunters after it revealed that it had paid $16,500 (£9,900) to developers for plugging 27 Chrome web browser vulnerabilities.

The move paves the way for the launch of the Chrome 11.

Chrome 11, which launched to the stable channel for Windows, Mac and Linux 27 April, includes such perks as speech input translation.

Bug Hunting

Chromium development community members and other tinkerers of the open-source browser found a slew of flaws with the latest application build.

These included 18 holes rated “high,” six dubbed “medium” and three considered “low” risk. Per policy, Google rewarded most of them for their discoveries.

While a high-risk stale pointer in floating object handling and a low-risk pop-up block bypass via plug-ins went unpaid, Google paid between $500 (£300) and $3,000 (£1,800) for vulnerabilities such as:

  • Medium-risk lack of thread safety in MIME handling ($500/£300)
  • High-risk corrupt node trees with mutation events ($1,000/£600)
  • High-risk use-after-free in DOM id handling ($1,500/£900)
  • High-risk dangling pointers in DOM id map ($2,000/£1,200)
  • High-risk possible URL bar spoofs with navigation errors and interrupted loads ($3,000/£1,800)

See the full list of flaws here. Google also thanked miaubiz, kuzzcc, Sławomir Błażek, Drew Yao and Braden Thomas of Apple’s product security team for working with the Chrome team to ensure bugs don’t reach the stable channel.

Financial Rewards

Google pays the bug hunters through its Chromium Security Rewards program, a crowdsourced approach to letting developers earn money by helping Google squash bugs in Chrome. Mozilla also employs a bug-hunting payment system.

The company patched a slew of flaws in March ahead of the renowned Pwn2Own hacker contest, including 19 on 28 February, totalling $14,000 (£8,400), and 25 on 8 March totalling more than $16,000 (£9,605). Google paid out another $8,500 (£5,100) on 24 March for six bug fixes.

In total, Google has paid out more than $100,000 (£60,000) worth of rewards since launching the rewards program last January. Google’s own security team spent part of March shoring up SSL certificates in the wake of the Comodo Security hack, which exposed digital certificates.