Google fixes severe Chrome flaws

The Chrome flaws could lead to remote code execution

Google has been forced to release new security fixes for multiple high severity vulnerabilities in its Chrome browser which could lead to an attacker taking over a victim's PC remotely.

The flaws, which were issued as part of the Chrome 2.0.172.43 update sent automatically to users, include two rated 'high severity' and one 'medium risk', according to a security advisory posted by Google engineering programme manager Jonathan Conradt.

The first, CVE-2009-2935, involves a flaw in the V8 JavaScript engine which could allow "specially-crafted JavaScript on a web page to read unauthorised memory, bypassing security checks".

"It is possible that this could lead to disclosing unauthorised data to an attacker, or allow an attacker to run arbitrary code," wrote Conradt. "An attacker might be able to run arbitrary code within the Google Chrome sandbox."

The other vulnerability, CVE-2009-2416, could lead to pages using XML causing a Google Chrome tab process to crash, said the firm.

"A malicious XML payload may be able to trigger a use-after-free condition. Other tabs are unaffected," read the advisory.

Google stressed, however, that Chrome's sandbox feature prevented the vulnerabilities from being rated 'critical'.