In addition, this release fixes the following security issues:
CVE-2009-2555 Heap overflow with Javascript regular expressions
Evaluating a specially-crafted regular expression in Javascript on a web page can lead to memory corruption and possibly a heap overflow. Visiting a maliciously crafted website may lead to a renderer (tab) crash or arbitrary code execution in the Google Chrome sandbox.
Severity: High. An attacker might be able to run arbitrary code within the Google Chrome sandbox.
Credit: This issue was found by the Google Chrome security team.
Mitigations:
A victim would need to visit a page under an attacker's control.
Any code that an attacker might be able to run inside the renderer process would be inside the sandbox. Click here for more details about sandboxing.
CVE-2009-2556 Memory corruption in the browser process
A compromised renderer (tab) process could cause the browser process to allocate very large memory buffers. This error could cause the browser process (and all tabs) to crash or possibly allow arbitrary code execution with the privileges of the logged on user. To exploit this vulnerability, an attacker would need to be able to run arbitrary code inside the renderer process.
Severity: Critical. In conjunction with a vulnerability allowing arbitrary code to run in the renderer, an attacker might be able to run code with the privileges of the logged on user.
Credit: This issue was found by the Google Chrome security team.
Mitigations:
A victim would need to visit a page under an attacker's control.
The attacker must exploit a second vulnerability to control the renderer process.
Google Chrome 3.0.193.1 has been released to the Dev channel to fix a small set crashes related to: V8, autocomplete, tab dragging, and context menus (bugs 16276, 13500, 16280, 14594).
Original post:
Google Chrome 3.0.193.0 has been released to the Dev channel for Windows.
Highlights in this release:
Fixed issue 15199 where new windows are opened off screen, in certain conditions, for dual monitor users.
Fixed issue 16052 where a tab would close if a new url was navigated to too quickly during a page load.
Alerts/authentication windows are no longer wrapped by an OS window.
Windowed plugins like Flash no longer hang after a print dialog is displayed.