Google has fixed 12 security vulnerabilities in Chrome, including six high-risk bugs. The new version of the browser includes a number of fixes for bugs discovered by external researchers as well as by Google’s own internal security team.
Two of the more serious vulnerabilities patched in Chrome include use-after-free bugs in various elements of the browser, and there also are two out of bounds reads in the browser. Those are listed as high-risk flaws, as well. But perhaps the most interesting bug fixed in the new version is a medium-risk vulnerability related to the TLS negotiation process. During that process, Chrome failed to do a check of some certificates it encountered.
Here’s the full list of bugs fixed Chrome 31:
$500] Medium CVE-2013-6621: Use after free related to speech input elements. Credit to Khalil Zhani.
[$2000] High CVE-2013-6622: Use after free related to media elements. Credit to cloudfuzzer.
[$500] High CVE-2013-6623: Out of bounds read in SVG. Credit to miaubiz.
[$1000] High CVE-2013-6624: Use after free related to “id” attribute strings. Credit to Jon Butler.
[$2000] High CVE-2013-6625: Use after free in DOM ranges. Credit to cloudfuzzer.
 Low CVE-2013-6626: Address bar spoofing related to interstitial warnings. Credit to Chamal de Silva.
[$4000] High CVE-2013-6627: Out of bounds read in HTTP parsing. Credit to skylined.
[$1000] Medium CVE-2013-6628: Issue with certificates not being checked during TLS renegotiation. Credit to Antoine Delignat-Lavaud and Karthikeyan Bhargavan from Prosecco of INRIA Paris.
 Medium-Critical CVE-2013-2931: Various fixes from internal audits, fuzzing and other initiatives.
 Medium CVE-2013-6629: Read of uninitialized memory in libjpeg and libjpeg-turbo. Credit to Michal Zalewski of Google.
 Medium CVE-2013-6630: Read of uninitialized memory in libjpeg-turbo. Credit to Michal Zalewski of Google.
 High CVE-2013-6631: Use after free in libjingle. Credit to Patrik Höglund of the Chromium project.
As part of its bug reward program, Google paid out $11,000 in bounties to external researchers.