[r23965] Unicode text could sometimes produce garbled Omnibox dropdown entries. (Issue: 5490)
[r23967] Fix problems with plugin z-order. (Issue: 15840)
[r24033] Fix a crash on Windows and Linux. (Issue: 17569)
[r24151] Fix regression (since Chrome 2.0.172.1) where some gzipped files (e.g. script) were not unzipped before evaluation, making them unusable. (Issue: 16430)
[r24170] Faster startup with custom themes. (Issue: 18768)
[r24179] Graphical errors with some themes. (Issue: 20139)
[r24189] Problems with video/audio tag playback and looping at rates other than 1.0. (Issues: 19856, 19105)
[r24192] Properly align cursors used for middle-mouse-autoscroll with the original click location. (Issue: 6173)
Windows
[r23915] During uninstall, if Chrome was the default browser, prompt user to choose a new default. (Issue: 14023)
[r23849] Fix clicking/noise when playing video/audio tag content with 48 or 96 kHz audio. (Issue: 17940)
[r24198] Remove "Clear browsing data" and "Import bookmarks & settings" from Tools menu since they are now available in the Options. (Issue: 20137)
There is a known issue, 20452, that the themes gallery does not recognize the new version of Google Chrome. This issue is purely aesthetic and does not affect a user's ability to install themes from the gallery.
CVE-2009-2935 Unauthorized memory read from Javascript
A flaw in the V8 Javascript engine might allow specially-crafted Javascript on a web page to read unauthorized memory, bypassing security checks. It is possible that this could lead to disclosing unauthorized data to an attacker or allow an attacker to run arbitrary code.
Severity: High. An attacker might be able to run arbitrary code within the Google Chrome sandbox.
Credit: This issue was found by Mozilla Security.
Mitigations:
A victim would need to visit a page under an attacker's control.
Any code that an attacker might be able to run inside the renderer process would be inside the sandbox. Click here for more details about sandboxing.
Security Fix: Treat weak signatures as invalid
Google Chrome no longer connects to HTTPS (SSL) sites whose certificates are signed using MD2 or MD4 hashing algorithms. These algorithms are considered weak and might allow an attacker to spoof an invalid site as a valid HTTPS site.
Pages using XML can cause a Google Chrome tab process to crash. A malicious XML payload may be able to trigger a use-after-free condition. Other tabs are unaffected.
More info: See the CVE entries noted in this report.
Severity: High. An attacker might be able to run arbitrary code within the Google Chrome sandbox.
Credit:Original discovery by Rauli Kaksonen and Jukka Taimisto from the CROSS project at Codenomicon Ltd. The Google Chrome security team determined that Chrome was affected.
Mitigations:
A victim would need to visit a page under an attacker's control.
Any code that an attacker might be able to run inside the renderer process would be inside the sandbox. Click here for more details about sandboxing.
