The two bugs plugged in the latest version of Chrome are a use-after-free in PDF viewer and out-of-bounds writes in PDF viewer. No bug bounties were doled out because both were identified by the Google Security Team.
For Flash, Chrome is switching to Google’s own platform PPAPI from the old NPAPI architecture, which Google software engineer Justin Schuh describes as a “thin layer of glue” between the web browser and a native application.
“By porting Flash to PPAPI we’ve been able to achieve what was previously impossible with NPAPI for the 99.9% of Chrome users that rely on Flash. Windows Flash is now inside a sandbox that’s as strong as Chrome’s native sandbox, and dramatically more robust than anything else available. And for the first time ever, Windows XP users (specifically, over 100 million Chrome users) have a sandboxed Flash—which is critical given the absence of OS support for security features like ASLR and integrity levels”, Shuh wrote this week in a blog.
In addition, moving Flash to PPAPI has enabled Google to reduce crashes by 20% by eliminating NPAPI’s complexity and legacy code. “And because PPAPI doesn’t let the OS bleed through, it’s the only way to use all Flash features on any site in Windows 8 Metro mode”, he added.
Google plans to ship the PPAPI Flash port for Mac OS X soon. Linux and Chrome OS users have already been benefitting from PPAPI Flash. “Soon all Chrome users will have access to the improved security, stability, and performance of PPAPI Flash”, Shuh concluded.