Lucene search

K
chromeHttps://chromereleases.googleblog.comGCSA-1165379008931647023
HistoryJul 20, 2023 - 12:00 a.m.

Stable Channel Update for ChromeOS / ChromeOS Flex

2023-07-2000:00:00
https://chromereleases.googleblog.com
chromereleases.googleblog.com
10
chromeos
m115
stable
update
security
fixes
rewards
bug
use-after-free
out of bounds read
insufficient validation
titan c firmware
chromebook
community
report
feedback
channel switch
rewards program

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

32.4%

ChromeOS M115 Stable

The Stable channel is being updated to OS version: 15474.61.0 Browser version: 115.0.5790.131 for most ChromeOS devices.

If you find new issues, please let us know one of the following ways

  1. File a bug
  2. Visit our ChromeOS communities
    1. General: Chromebook Help Community
    2. Beta Specific: ChromeOS Beta Help Community
  3. Report an issue or send feedback on Chrome

Interested in switching channels? Find out how.

You can find the release notes here.

Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven't yet fixed.

[$3000] [1451803] High CVE-2023-3729 Use-after-free in Ash. Reported by @ginggilBesel.

[$TBD] [1444766] High CVE-TBD Use-after-free in ChromeOS Reported by ayano2023th.

[$1000] [1441306] High CVE-2023-3731 Use-after-free in Ash. Reported by ChaobinZhang.

[NA] [1459277] Medium CVE-2023-3497 Out of bounds read in Titan C firmware. Found internally by Google

[$2000] [1398986] Low CVE-2023-3739 Insufficient validation of untrusted input in ChromeOS. Reported by Rory McNamara.

We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.

Daniel Gagnon,
Google ChromeOS

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

0.001 Low

EPSS

Percentile

32.4%