Google Chrome Stable Update 104 release notes: 27 major issues fixed for Windows, Mac, and Linux desktop

Google Chrome recently released a major update for its desktop version, fixing over 27 major issues reported by Chrome users.

Currently, Google Chrome is the biggest browser by a massive margin. Paired with Google’s own search engine, it has become the go-to browser for everyone across desktop and mobile devices, easily overtaking Microsoft Edge or Apple’s Safari.

The popular browser's bug bounty program has led to the discovery of many oversights and issues in the browser. With the latest update for the stable version 104 for Windows, Mac, and Linux desktops, Google has fixed more than 20 major issues. With that being said, let’s take a look at the release notes.

---

Google Chrome Stable Update 104 fixes major issues for Windows, Mac, and Linux desktops

The browser's team is delighted to announce the promotion of Chrome 104 to the stable channel for Windows, Mac, and Linux. Google Chrome 104 is also promoted to Google's new extended stable channel for both Windows and Mac. The upcoming update will be rolled out over the coming days/weeks.

Chrome 104.0.5112.79 (Mac/Linux) and 104.0.5112.79/80/81 (Windows) contain quite a few fixes and improvements, with a list of all of the changes now available in the browser's update log. Keep a look out for the upcoming Chrome and Chromium blog posts regarding the new features and all of the major efforts delivered in the stable update 104.

---

Security fixes and rewards

It should be noted that access to bug details and links may be kept restricted by Google until a majority of users are updated with a fix. Google will also retain restrictions if the bug exists in one or multiple third-party libraries that other projects similarly depend on, but haven’t been fixed as of yet.

From the latest information, the stable update 104 includes 27 security fixes. Listed below are the highlighted fixes that were contributed by external researchers. Please visit the Chrome Security Page for more information.

• [$15000] [1325699] High CVE-2022-2603: Use after free in Omnibox. As reported by Anonymous on 2022-05-16
• [$10000] [1335316] High CVE-2022-2604: Use after free in Safe Browsing. As reported by Nan Wang (@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-06-10
• [$7000] [1338470] High CVE-2022-2605: Out of bounds read in Dawn. Reported by Looben Yang on 2022-06-22
• [$5000] [1330489] High CVE-2022-2606: Use after free in Managed devices API. As reported by Nan Wang (@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-05-31
• [$3000] [1286203] High CVE-2022-2607: Use after free in Tab Strip. As reported by @ginggilBesel on 2022-01-11
• [$3000] [1330775] High CVE-2022-2608: Use after free in Overview Mode. As reported by Khalil Zhani on 2022-06-01
• [$TBD] [1338560] High CVE-2022-2609: Use after free in Nearby Share. As reported by koocola (@alo_cook) and Guang Gong of 360 Vulnerability Research Institute on 2022-06-22
• [$8000] [1278255] Medium CVE-2022-2610: Insufficient policy enforcement in Background Fetch. As reported by Maurice Dauer on 2021-12-09
• [$5000] [1320538] Medium CVE-2022-2611: Inappropriate implementation in Fullscreen API. As reported by Irvan Kurniawan (sourc7) on 2022-04-28
• [$5000] [1321350] Medium CVE-2022-2612: Side-channel information leakage in Keyboard input. Reported by Erik Kraft ([email protected]), Martin Schwarzl ([email protected]) on 2022-04-30
• [$5000] [1325256] Medium CVE-2022-2613: Use after free in Input. Reported by Piotr Tworek (Vewd) on 2022-05-13
• [$5000] [1341907] Medium CVE-2022-2614: Use after free in Sign-In Flow. Reported by raven at KunLun lab on 2022-07-05
• [$4000] [1268580] Medium CVE-2022-2615: Insufficient policy enforcement in Cookies. As reported by Maurice Dauer on 2021-11-10
• [$3000] [1302159] Medium CVE-2022-2616: Inappropriate implementation in Extensions API. As reported by Alesandro Ortiz on 2022-03-02
• [$2000] [1292451] Medium CVE-2022-2617: Use after free in Extensions API. As reported by @ginggilBesel on 2022-01-31
• [$2000] [1308422] Medium CVE-2022-2618: Insufficient validation of untrusted input in Internals. As reported by asnine on 2022-03-21
• [$2000] [1332881] Medium CVE-2022-2619: Insufficient validation of untrusted input in Settings. As reported by Oliver Dunk on 2022-06-04
• [$2000] [1337304] Medium CVE-2022-2620: Use after free in WebUI. As reported by Nan Wang (@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2022-06-17
• [$1000] [1323449] Medium CVE-2022-2621: Use after free in Extensions. As reported by Huyna at Viettel Cyber Security on 2022-05-07
• [$1000] [1332392] Medium CVE-2022-2622: Insufficient validation of untrusted input in Safe Browsing. Reported by Imre Rad (@ImreRad) and @j00sean on 2022-06-03
• [$1000] [1337798] Medium CVE-2022-2623: Use after free in Offline. As reported by raven at KunLun lab on 2022-06-20
• [$TBD] [1339745] Medium CVE-2022-2624: Heap buffer overflow in PDF. As reported by YU-CHANG CHEN and CHIH-YEN CHANG, working with DEVCORE Internship Program on 2022-06-27

Google's own ongoing internal security work was responsible for a wide range of fixes, which are as follows:

• [1349193] Various fixes from internal audits, fuzzing, and other initiatives

Many of Google Chrome's security bugs are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, LibFuzzer, or AFL.