Zaifliklar
Chrome 157 213 ta zaiflikni tuzatish bilan barqaror kanalga chiqarildi, ulardan yettitasi jiddiy deb baholandi
Brauzer yangilanishi o'nlab xotira xavfsizligi xatolari va noto'g'ri/yo'qolgan avtorizatsiya muammolarini bartaraf etadi.
Muallif
Ionut Arghire
| 2026-yil 4-noyabr (ET bo'yicha 6:38)
Google Chrome 157 ni barqaror kanalga 213 ta zaiflikni tuzatish bilan chiqarib yubordi, jumladan yettita jiddiy xotira xavfsizligi xatolari.
Ro'yxatning yuqori qismida Dawn'dagi bufer to'lib ketishi muammosi turibdi — bu WebGPU standartining ochiq manbali va ko'p platformali amalga oshirilishi. Bu xatoni topgan tadqiqotchiga 10 000 dollar mukofot berildi.
Ikkinchisi — ochiq manbali grafik dvigatel abstraksiya qatlami ANGLE'dagi xotira buzilishi, buning uchun 1 000 dollar mukofot to'langan.
Qolgan beshta jiddiy xato (to'rtta foydalanishdan keyingi xato va bitta bufer to'lib ketishi) uchun mukofotlar ro'yxatga olinmagan. Google ulardan ikkitasini o'zi xabar qilgan, Anthropic'dan Xinyang Ge ikkitasini, tadqiqotchi Wenbin Liu esa beshinchisini xabar qilgan.
Chrome 157 shuningdek 77 ta yuqori darajadagi zaiflikni tuzatadi, jumladan o'nlab tashqi tadqiqotchilar tomonidan xabar qilinganlari. Biroq Google faqat ikkitasining mukofotlarini e'lon qilgan: 10 000 dollar noto'g'ri avtorizatsiya uchun va 2 000 dollar chegaradan tashqari o'qish uchun.
Google maslahatchisiga ko'ra, kompaniya xabar qilgan tadqiqotchilarga jami 31 000 dollar mukofot to'lagan, lekin 39 ta xato uchun to'lanadigan mukofotlar hali aniqlanmagan.
Reklama. O'qishni davom ettirish uchun pastga aylantiring.
Yangi brauzer yangilanishi bartaraf etadigan zaifliklarning eng keng tarqalgan turlari: noto'g'ri/yo'qolgan avtorizatsiya (51), foydalanishdan keyingi xato (45), UI noto'g'ri tasvirlanishi (19), tur aralashuvi (13), ma'lumot sizib chiqishi (13), chegaradan tashqari o'qish/yozish (11), noto'g'ri kirish tekshiruvi (9) va boshlanmagan resurs (9).
Google bu xavfsizlik kamchiliklaridan birortasi ham yovuz maqsadlarda ishlatilayotgani haqida hech narsa aytmaydi, lekin foydalanuvchilar brauzerlarini iloji boricha tezroq yangilashlari kerak.
Eng so'nggi Chrome versiyasi Windows va macOS uchun 157.0.8103.38/.39, Linux uchun esa 157.0.8103.38 sifatida tarqatilmoqda.
Bog'liq:Android'ning 2026-yil noyabr yangilanishlari 200 dan ortiq zaiflikni tuzatadi
Bog'liq:Node-RED'dagi jiddiy xato hujumlarda ishlatilmoqda
Bog'liq:Meta Muse mukofot dasturining eng yuqori natijalarini e'lon qildi, to'lovlar 1,2 million dollarga yetdi
Bog'liq:Chrome va Firefox yangilanishlari 200 dan ortiq zaiflikni tuzatadi
Yozgan muallif: Ionut Arghire
Ionut Arghire SecurityWeek uchun xalqaro muxbir.
Kundalik axborot byulleteni
So'nggi kiberxavfsizlik tahdidlari, tendentsiyalar va mutaxassis fikrlari haqida xabardor bo'lish uchun SecurityWeek elektron pochta byulleteniga obuna bo'ling.
Biznes elektron pochta*
emailsignupsource
Qo'shimcha ma'lumot uchun Maxfiylik siyosatimizni o'qing.
Ionut Arghiredan ko'proq
- Google 1,3 million Android qurilmasidan iborat XCPE botnetini yo'q qildi
- Revolve ma'lumotlar sizib chiqishi kamida 200 000 kishiga ta'sir qildi
- Google bulutda ildiz olish xatosi uchun 250 000 dollarlik mukofot e'lon qildi
- Zararli Claude Code kengaytmasi Cursor ta'minot zanjiri hujumida tarqatildi
- Chainalysis AI yordamida amalga oshirilgan kiberhujumdan so'ng ma'lumotlar sizib chiqishini e'lon qildi
- PHP2Shell hujumlari Palo Alto devorlarini ildizga kiritdi, lekin WordPress'ga qarshi muvaffaqiyatsiz bo'ldi
- Bulletproof Host Virtualine domeni FBI tomonidan musodara qilindi
- Yangi WordPress zaifligi hujumchilarning diqqat markazida
So'nggi yangiliklar
- Kodlash topshirig'i tuzatilgan, AI vositasi suiiste'mol qilingan — 6 milliard dollarlik Binance o'g'riligiga yo'l ochildi
- Shimoliy Koreya Pyongyang AQShning Binance o'g'riligi haqidagi da'volariga qarshi dengizga raketalar uchirdi
- Meta Muse mukofot dasturining eng yuqori natijalarini e'lon qildi, to'lovlar 1,2 million dollarga yetdi
- Frontline Education ma'lumotlar sizib chiqishi 1,3 milliondan ortiq kishiga ta'sir qildi
- CrowdStrike AI xavfsizlik firmalari Fiddler va Dreadnode uchun 495 million dollar to'layotgani xabar qilindi
- Android'ning 2026-yil noyabr yangilanishlari 200 dan ortiq zaiflikni tuzatadi
- Node-RED'dagi jiddiy xato hujumlarda ishlatilmoqda
- Buyuk Britaniya kiber rahbari 2028-yilga kelib Buyuk Britaniya muhim infratuzilmasiga AI kiberhujumlari bo'lishini aytdi
Trendda
Zararli Claude Code kengaytmasi Cursor ta'minot zanjiri hujumida tarqatildi
CrowdStrike AI xavfsizlik firmalari Fiddler va Dreadnode uchun 495 million dollar to'layotgani xabar qilindi
enSilo B seriyasida 23 million dollar mablag' jalb qildi
Ivanti Connect Secure hujum zanjirida ishlatilgan yana ikkita nol kunlik xatoni tuzatdi
FBI Shimoliy Koreyaning Binance o'g'riligi bilan bog'liq 600 dan ortiq manzilni aniqladi
Revolve ma'lumotlar sizib chiqishi kamida 200 000 kishiga ta'sir qildi
100 dan ortiq Yevropa do'konlari supermarket sovutgich hujumlari qaytishi bilan zararlangan
Kiberxavfsizlik M&A 2026-yil oktyabrda e'lon qilingan 37 ta bitim
Kundalik axborot byulleteni
So'nggi tahdidlar, tendentsiyalar va texnologiyalar, shuningdek, soha mutaxassislarining chuqur fikrlari haqida xabardor bo'lish uchun SecurityWeek elektron pochta byulleteniga obuna bo'ling.
Biznes elektron pochta*
emailsignupsource
Maxfiylik siyosatimizni o'qing.
Vebinar: Agentik pentestlash kuchliroq CTEM dasturi uchun
2026-yil 4-noyabr
Pentestlar orasidagi xavfsizlik bo'shliqlarini yoping. Ushbu sessiyaga qo'shiling va agentik pentestlashni o'rganing hamda CTEM dasturingizda uzluksiz ta'sir tekshiruvini amalga oshirish uchun amaliy asosga ega bo'ling.
Ro'yxatdan o'ting
Virtual tadbir: CISO Forum 2026 sammiti
2026-yil 10 va 11-noyabr
CISO'lar, yuqori darajadagi kiberxavfsizlik rahbarlari, amaliyotchilar, soha mutaxassislari va boshqa xavfsizlik rahbarlarini amaliy tajriba almashish va korporativ kiberxavfsizlik strategiyasini shakllantirayotgan masalalarni ko'rib chiqish uchun birlashtiramiz.
Ro'yxatdan o'ting
Harakatdagi odamlar
Barracuda Dan Fletcher'ni moliyaviy direktor (CFO) etib tayinladi.
Artemis Security Arun Singh'ni CGO etib tayinladi.
General Paul M. Nakasone Armadin direktorlar kengashiga qo'shildi.
Harakatdagi ko'proq odamlar
Mutaxassis fikrlari
Parollar parollardan yaxshiroq. Lekin ular yetarli emas.
Tashkilotlar parollarni yo'q qilgan sari, hujumchilar moslashadi. Avtorizatorga to'g'ridan-to'g'ri hujum qilish o'rniga, ular uning atrofidagi imkoniyatlarni qidiradilar. (Torsten George)
Xavf shaxsiy bo'lganda: Xavfsizlik rahbarlari saraton tashxisidan nimani o'rganishi mumkin
Xavf menejerlari zaif signallarni aniqlash, buzilishlarga tayyorlanish va noaniqlik ostida qiyin qarorlar qabul qilishga o'rgatilgan. Lekin bu fan tizim yoki korxona emas, balki siz bo'lganingizda boshqacha ko'rinadi. (Steve Durbin)
Hech kim xavfsizlik anketasiga ishonmaydi. Shunga qaramay, biz unga tayanamiz.
Deyarli har bir B2B bitimni nazorat qiladigan jarayon — yuboruvchining o'zi ishonmaydigan va qabul qiluvchining qabul qiladigan o'z-o'zini baholash. Nihoyat, kompaniyalar o'rtasida ishonch uchun yaxshiroq asos bor. (Sravish Sridhar)
Bu normal: NetScaler nol kunlik xatolari bizga yangi normal haqida nimani aytadi
Agar tez orada Citrix NetScaler tuzatishlari yana bir marta chiqarilsa, tuzatish boshqaruv quvurlarini tayyor saqlang. (Tod Beardsley)
AI dasturiy ta'minot xavfsizligining kaliti tezlik emas, balki yetuklik
Sizning dasturchilaringiz AI qabul qilish shkalasida qayerda turishi xavfsizlik xavfini qanday hal qilayotganingizga haqiqiy ta'sir qiladi. (Matias Madou)
Vulnerabilities
Chrome 157 Rolls Out With 213 Security Fixes, Seven Rated Critical
The browser update resolves dozens of memory safety bugs and incorrect/missing authorization issues.
By
Ionut Arghire
| November 4, 2026 (6:38 AM ET)
*
Google has promoted Chrome 157 to the stable channel with patches for 213 vulnerabilities, including seven critical memory safety bugs.
At the top of the list is a buffer overflow issue in Dawn, the open source and cross-platform implementation of the WebGPU standard. It earned the reporting researcher a $10,000 reward.
The second is a memory corruption in the open source graphics engine abstraction layer ANGLE that was awarded a $1,000 bug bounty.
No rewards were listed for the remaining five critical flaws (four use-after-free defects and a buffer overflow). Google reported two of them, Anthropic’s Xinyang Ge reported two, and researcher Wenbin Liu reported the fifth.
Chrome 157 also fixes 77 high-severity vulnerabilities, including more than a dozen reported by external researchers. However, Google has disclosed only the bounties paid for two of them, namely $10,000 for an incorrect authorization, and $2,000 for an out-of-bounds read.
Per Google’s advisory, the company handed out $31,000 in rewards to the reporting researchers, but it has not determined the bug bounties to be paid for 39 of the flaws.
Advertisement. Scroll to continue reading.
The most common types of vulnerabilities the fresh browser update resolves include incorrect/missing authorization (51), use-after-free (45), UI misrepresentation (19), type confusion (13), information leak (13), out-of-bounds read/write (11), improper input validation (9), and uninitialized resource (9).
Google makes no mention of any of these security defects being exploited in the wild, but users should update their browsers as soon as possible.
The latest Chrome iteration is now rolling out as versions 157.0.8103.38/.39 for Windows and macOS, and as version 157.0.8103.38 for Linux.
Related:Android’s November 2026 Updates Patch Over 200 Vulnerabilities
Related:Critical Node-RED Flaw Exploited in Attacks
Related:Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 Million
Related:Chrome and Firefox Updates Patch Over 200 Vulnerabilities
Written ByIonut Arghire
Ionut Arghire is an international correspondent for SecurityWeek.
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
More from Ionut Arghire
- Google Dismantles XCPE Botnet of 1.3 Million Android Devices
- Revolve Data Breach Impacts at Least 200,000 People
- Google Introduces $250,000 Root-in-Cloud Bug Bounty Reward
- Malicious Claude Code Extension Served in Cursor Supply Chain Attack
- Chainalysis Discloses Data Breach Following AI-Driven Cyberattack
- PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
- Bulletproof Host Virtualine Loses Its Domain to FBI Seizure
- Fresh WordPress Vulnerability in Attackers’ Crosshairs
Latest News
- Rigged Coding Assignment, Abused AI Tool Opened Path to $6 Billion Binance Heist
- North Korea Launches Missiles Toward the Sea as Pyongyang Protests Against US Claims on Binance Hack
- Meta Shares Top Muse Bug Bounty Findings as Payouts Reach $1.2 Million
- Frontline Education Data Breach Impacts Over 1.3 Million
- CrowdStrike Reportedly Paying $495 Million for AI Security Firms Fiddler, Dreadnode
- Android’s November 2026 Updates Patch Over 200 Vulnerabilities
- Critical Node-RED Flaw Exploited in Attacks
- UK Cyber Chief Says the UK Will Face AI Cyberattacks on Critical Infrastructure by 2028
Trending
Malicious Claude Code Extension Served in Cursor Supply Chain Attack
CrowdStrike Reportedly Paying $495 Million for AI Security Firms Fiddler, Dreadnode
enSilo Raises $23 Million in Series B Funding
Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist
Revolve Data Breach Impacts at Least 200,000 People
Over 100 European Stores Hit as Supermarket Fridge Attacks Return
Cybersecurity M&A Roundup: 37 Deals Announced in October 2026
Daily Briefing Newsletter
Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.
Business Email*
emailsignupsource
Read our Privacy Policy for more information.
Webinar: Agentic Pentesting for a Stronger CTEM Program
November 4, 2026
Close the security gaps between pentests. Join this session to explore agentic pentesting and gain a practical framework for continuous exposure validation in your CTEM program.
Register
Virtual Event: CISO Forum 2026 Summit
November 10 & 11, 2026
Join as we bring together CISOs, senior cybersecurity executives, practitioners, industry experts, and other security leaders to share practical experience and examine the issues shaping enterprise cybersecurity strategy.
Register
People on the Move
Barracuda has appointed Dan Fletcher as CFO.
Artemis Security has appointed Arun Singh as CGO.
General Paul M. Nakasone has joined Armadin’s Board of Directors.
More People On The Move
Expert Insights
*
Passkeys Are Better Than Passwords. But They Are Not Enough.
As organizations eliminate passwords, attackers will adapt. Instead of attacking the authenticator directly, they will look for opportunities around it.(Torsten George)
When Risk Becomes Personal: What Security Leaders Can Learn From a Cancer Diagnosis
Risk managers are trained to spot weak signals, plan for disruption and make hard decisions under uncertainty. But the discipline looks different when the risk is not a system or an enterprise, but you.(Steve Durbin)
Nobody Trusts the Security Questionnaire. We Rely on It Anyway.
The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies.(Sravish Sridhar)
This is Fine: What NetScaler Zero-Days Tell Us About the New Normal
Keep your patch management pipelines primed in case another round of Citrix NetScaler patches get released soon.(Tod Beardsley)
The Key to AI Software Security Isn’t Speed, It’s Maturity
Where your developers sit on the AI adoption scale has a real impact on how you are addressing security risk.(Matias Madou)