Chrome Releases: Stable Update: Security Fix

Chrome Releases

Release updates from the Chrome team

Stable Update: Security Fix

donderdag 23 april 2009

Edit (24 April): Removed "Such an attack only works if Chrome is not already running."

Google Chrome's Stable channel has been updated to 1.0.154.59 to fix a security issue:
CVE-2009-1412 ChromeHTML protocol handler same-origin bypassAn error in handling URLs with a chromehtml: protocol could allow an attacker to run scripts of his choosing on any page or enumerate files on the local disk under certain conditions.
If a user has Google Chrome installed, visiting an attacker-controlled web page in Internet Explorer could have caused Google Chrome to launch, open multiple tabs, and load scripts that run after navigating to a URL of the attacker's choice.
See http://code.google.com/p/chromium/issues/detail?id=9860 for more details.
Affected versions: 1.0.154.55 and earlier
Severity: High. This allows universal cross-site scripting (UXSS) without user interaction under certain conditions.
Credit: Roi Saltzman (roisa@il.ibm.com) Security Researcher at IBM Rational Application Security Research Group
--Mark LarsonGoogle Chrome Program Manager

Labels: Stable updates

Labels

Admin Console 43
Android WebView 19
Beta 26
Beta update 22
Beta updates 2321
chrome 15
Chrome Dev for Android 217
Chrome for Android 1258
Chrome for iOS 544
Chrome for Meetings 5
Chrome OS 1172
Chrome OS Flex 40
Chrome OS Management 13
Chromecast Update 6
ChromeOS 416
ChromeOS Flex 405
Desktop Update 1466
dev update 268
Dev updates 1694
Early Stable Updates 112
Extended Stable updates 218
Flash Player update 5
Flex 1
Hangouts Meet hardware 5
LTS 146
stable 13
Stable updates 1559

Archive

2026
- sep
- aug
- jul
- jun
- mei
- apr
- mrt
- feb
- jan

2025
- dec
- nov
- okt
- sep
- aug
- jul
- jun
- mei
- apr
- mrt
- feb
- jan

2024
- dec
- nov
- okt
- sep
- aug
- jul
- jun
- mei
- apr
- mrt
- feb
- jan

2023
- dec
- nov
- okt
- sep
- aug
- jul
- jun
- mei
- apr
- mrt
- feb
- jan

2022
- dec
- nov
- okt
- sep
- aug
- jul
- jun
- mei
- apr
- mrt
- feb
- jan

2021
- dec
- nov
- okt
- sep
- aug
- jul
- jun
- mei
- apr
- mrt
- feb
- jan

2020
- dec
- nov
- okt
- sep
- aug
- jul
- jun
- mei
- apr
- mrt
- feb
- jan

2019
- dec
- nov
- okt
- sep
- aug
- jul
- jun
- mei
- apr
- mrt
- feb
- jan

2018
- dec
- nov
- okt
- sep
- aug
- jul
- jun
- mei
- apr
- mrt
- feb
- jan

2017
- dec
- nov
- okt
- sep
- aug
- jul
- jun
- mei
- apr
- mrt
- feb
- jan

2016
- dec
- nov
- okt
- sep
- aug
- jul
- jun
- mei
- apr
- mrt
- feb
- jan

2015
- dec
- nov
- okt
- sep
- aug
- jul
- jun
- mei
- apr
- mrt
- feb
- jan

2014
- dec
- nov
- okt
- sep
- aug
- jul
- jun
- mei
- apr
- mrt
- feb
- jan

2013
- dec
- nov
- okt
- sep
- aug
- jul
- jun
- mei
- apr
- mrt
- feb
- jan

2012
- dec
- nov
- okt
- sep
- aug
- jul
- jun
- mei
- apr
- mrt
- feb
- jan

2011
- dec
- nov
- okt
- sep
- aug
- jul
- jun
- mei
- apr
- mrt
- feb
- jan

2010
- dec
- nov
- okt
- sep
- aug
- jul
- jun
- mei
- apr
- mrt
- feb
- jan

2009
- dec
- nov
- okt
- sep
- aug
- jul
- jun
- mei
- apr
- mrt
- feb
- jan

2008
- dec
- nov
- okt
- sep

Give us feedback in our
Product Forums.

Google
Privacy
Terms