VANCOUVER–Google has already patched the bugs used by researcher Sergey Glazunov to compromise Chrome on Wednesday as part of the company’s Pwnium contest at the CanSecWest conference here.
The vulnerability that Glazunov was ablt to exploit is a universal XSS and bad history navigation bug in the browser. Google on Thursday morning pushed out a new version of Chrome that includes a fix for the vulnerability. As part of the Pwnium contest, Glazunov took home a $60,000 reward for the compromise. The patch that Google released covers two distinct bugs in the browser.
Thus far, Glazunov is the only researcher to successfully compromise Chrome as part of the Pwnium contest. A team of researchers from VUPEN also compromised the Google browser on Wednesday, but that was part of the separate Pwn2Own contest and isn’t eligible for Google’s reward program.
Google has committed up to $1 million for the Pwnium contest, but it seems unlikely at this point that the company will end up paying out much of that fund. In order to qualify for the top $60,000 payout, a researcher needs to demonstrate a full compromise of Chrome, including a sandbox escape. Executing that kind of attack on the browser is considered quite difficult, as evidenced by the fact that Chrome was not targeted during Pwn2Own in past years. VUPEN’s success against Chrome this year was a first.
