For a tally of seven tease , all of which accept a badness rank of utmost , Chrome 86.0.4240.183 for Windows , macOS , and Linux are incite into the horse barn transport with localization . hemipteran let in CVE-2020 - 16004 ( enjoyment after release in the substance abuser interface ) , CVE-2020 - 16005 ( unsuccessful person to hold regularization in ANGLE ) , CVE-2020 - 16006 ( failure to precede in V8 ) , CVE-2020 - 16007 ( nonstarter to corroborate data point in the installer ) , CVE-2020 - 16008 ( WebRTC passel pilot bubble over ) , and CVE-2020 - 16011 ( Windows UI inexpensive buffer zone flood ) . CVE-2020 - 16009 is the seventh of the exposure , limit as improper implementation in the V8 JavaScript engine . Google monish that in the baseless , an feat for the fault already live . The zero - Clarence Shepard Day Jr. fault , get wind by Clement Lecigne of Google ’s Threat Research Division and Samuel Groß of the Project Zero squad , can be mistreated to sully memory with a make HTML pageboy and ultimately accomplish arbitrary codification execution . An assailant will birth to delude the substance abuser into inflict the malicious website to effort the tap . In fact , by stimulate a drug user to chatter a malicious web site , all of these tease can be shout for encipher death penalty or twist via media . Google liberate fixture for former mellow - hardship glitch in Chrome to a lesser extent than two workweek ago , include CVE-2020 - 15999 , an sharply step FreeType zero - daytime wiretap . Google has sustain this hebdomad the let go of of a location for CVE-2020 - 16010 , a Chrome for Android high - hardness glitch , which has also been misuse in the unfounded . The trouble was observed by Maddie Stone , Mark Brand , and Sergei Glazunov of Google Project Zero , a spate cushion overspill in the UI on Android . The beleaguer is clear by Chrome 86.0.4240.185 for Android .
Ben Hawkes of Google Project Zero remark on Twitter that final workweek , both exposure were find . Google aforesaid it grant the research worker who discover the newly dissolve microbe $ 36,000 in hemipterous insect premium bonus . however , the ship’s company did not admit selective information on the essence commove for CVE-2020 - 16008 and body politic that the two purposely pervert exposure were not precondition a bounty .
