Chrome Releases: Stable update: 2 WebKit security fixes

CHROME RELEASES

RELEASE UPDATES FROM THE CHROME TEAM

Stable update: 2 WebKit security fixes

Tuesday, June 9, 2009

Google Chrome's Stable channel has been updated to version 2.0.172.31 to fix two security issues in WebKit.
CVE-2009-1690 Memory corruptionA memory corruption issue exists in WebKit's handling of recursion in certain DOM event handlers. Visiting a maliciously crafted website may lead to a tab crash or arbitrary code execution in the Google Chrome sandbox. This update addresses the issue through improved memory management.
Severity: High. An attacker might be able to run arbitrary code within the Google Chrome sandbox.
Mitigations:

A victim would need to visit a page under an attacker's control.
Any code that an attacker might be able to run inside the renderer process would be inside the sandbox. Click here for more details about sandboxing.

CVE-2009-1718 Drag and drop information leakAn issue exists in WebKit's handling of drag events. This may lead to the disclosure of sensitive information when content is dragged over a maliciously crafted web page. This update addresses the issue through improved handling of drag events.
Severity: Medium. An attacker might be able to read data belonging to another web site, if a user can be convinced to select and drag data on an attacker-controlled site.
Mark Larson Google Chrome Program Manager