====================================================================

                             CERT-Renater

                 Note d'Information No. 2020/VULN473
_____________________________________________________________________

DATE                : 26/08/2020

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Google Chrome versions prior to 85.

=====================================================================
https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop_25.html
_____________________________________________________________________


Stable Channel Update for Desktop
Tuesday, August 25, 2020

 The Chrome team is delighted to announce the promotion of Chrome 85 to
the stable channel for Windows, Mac and Linux. This will roll out over
the coming days/weeks.


Chrome 85.0.4183.83 contains a number of fixes and improvements -- a
list of changes is available in the log. Watch out for upcoming Chrome
and Chromium blog posts about new features and big efforts delivered in
85


Security Fixes and Rewards

Note: Access to bug details and links may be kept restricted until a
majority of users are updated with a fix. We will also retain
restrictions if the bug exists in a third party library that other
projects similarly depend on, but haven’t yet fixed.

This update includes 20 security fixes. Below, we highlight fixes that
were contributed by external researchers. Please see the Chrome Security
Page for more information.


[$N/A][1109120] High CVE-2020-6558: Insufficient policy enforcement in
iOS. Reported by Alison Huffman, Microsoft Browser Vulnerability
Research on 2020-07-24

[$TBD][1116706] High CVE-2020-6559: Use after free in presentation API.
Reported by Liu Wei and Wu Zekai of Tencent Security Xuanwu Lab on
2020-08-15

[$5000][1108181] Medium CVE-2020-6560: Insufficient policy enforcement
in autofill. Reported by Nadja Ungethuem from www.unnex.de on 2020-07-22


[$1000][932892] Medium CVE-2020-6561: Inappropriate implementation in
Content Security Policy. Reported by Rob Wu on 2019-02-16

[$1000][1086845] Medium CVE-2020-6562: Insufficient policy enforcement
in Blink. Reported by Masato Kinugawa on 2020-05-27

[$1000][1104628] Medium CVE-2020-6563: Insufficient policy enforcement
in intent handling. Reported by Pedro Oliveira on 2020-07-12

[$500][841622] Medium CVE-2020-6564: Incorrect security UI in
permissions. Reported by Khalil Zhani on 2018-05-10

[$500][1029907] Medium CVE-2020-6565: Incorrect security UI in Omnibox.
Reported by Khalil Zhani on 2019-12-02

[$N/A][1065264] Medium CVE-2020-6566: Insufficient policy enforcement in
media. Reported by Jun Kokatsu, Microsoft Browser Vulnerability Research
on 2020-03-27

[$500][937179] Low CVE-2020-6567: Insufficient validation of untrusted
input in command line handling. Reported by Joshua Graham of TSS on
2019-03-01

[$500][1092451] Low CVE-2020-6568: Insufficient policy enforcement in
intent handling. Reported by Yongke Wang(@Rudykewang) and
Aryb1n(@aryb1n) of Tencent Security Xuanwu Lab (腾讯安全玄武实验室） on
2020-06-08

[$N/A][995732] Low CVE-2020-6569: Integer overflow in WebUSB. Reported
by guaixiaomei on 2019-08-20

[$N/A][1084699] Low CVE-2020-6570: Side-channel information leakage in
WebRTC. Reported by Signal/Tenable on 2020-05-19

[$N/A][1085315] Low CVE-2020-6571: Incorrect security UI in Omnibox.
Reported by Rayyan Bijoora on 2020-05-21


We would also like to thank all security researchers that worked with us
during the development cycle to prevent security bugs from ever reaching
the stable channel.

As usual, our ongoing internal security work was responsible for a wide
range of fixes:

    [1121299] Various fixes from internal audits, fuzzing and other
initiatives


Many of our security bugs are detected using AddressSanitizer,
MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity,
libFuzzer, or AFL.

Google Chrome
Srinivas Sista


=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================