Please see the Chromium security page for more detail. Note that the referenced bugs may be kept private until a majority of our users are up to date with the fix.
[72189] Low CVE-2011-1801: Pop-up blocker bypass. Credit to Chamal De Silva. [$1000] [82546] High CVE-2011-1804: Stale pointer in floats rendering. Credit to Martin Barbella. [82873] Critical CVE-2011-1806: Memory corruption in GPU command buffer. Credit to Google Chrome Security Team (Cris Neckar). [82903] Critical CVE-2011-1807: Out-of-bounds write in blob handling. Credit to Google Chrome Security Team (Inferno) and Kostya Serebryany of the Chromium development community.
The following bugs were fixed:
REGRESSION: selection extended by arrow keys flickers on LinkedIn.com. (Issue 83197). Have ConnectBackupJob try IPv4 first to hide potential long IPv6 connect timeout (Issue 81686). Mac plugin crashes are too low in stats (Issue 82172). Incorrect ACLs on the archived copy of setup.exe (Issue 82424)
