Google yesterday released Chrome version 25 for Windows, Mac, and Linux. Chrome 25 is all about features, including voice recognition support via the newly added Web Speech API and the blocking of silent extension installation.
The Web Speech API is a new JavaScript API that lets developers integrate speech recognition into their Web apps. Voice support is something Google has been pushing hard on Android phones but wants to bring to the desktop more and more. Aside from searching, the company envisions users dictating documents, controlling game characters, and even having a freestyle rap battle.
Here is what Google listed as new in Chrome version 25, according to its changelog notes on the previous beta and dev updates (added in chronological order, the full SVN revision log has more details):
- Stability fixes and memory fixes.
- Improvements in managing and securing your extensions.
- Better support for HTML5 time/date inputs.
- Javascript speech API support.
- Better WebGL error handling.
- And lots of other features for developers.
Google and Mozilla earlier this month showed off how they teamed up to make their respective browsers talk to each other with the addition of WebRTC support, an open source project that provides Internet users with the ability to communicate in real-time via voice and video by simply using a Real-Time Communications (RTC) compatible browser. The technology, which enables Web app developers to include real-time video calling and data sharing capabilities in their products, was added to Mozilla’s browser in Firefox 18 (preliminary support) and the Chrome 25 beta.
Today’s release means Chrome is the first stable browser to include full support; after you install it, you can try the feature out yourself here: Web Speech API Demonstration.
Google detailed it would be disabling external extension deployment options on Windows by default as of Chrome 25, and retroactively removing all extensions previously installed using them. Here’s what will happen when you launch Chrome 25 for the first time and you have previously-silently-installed extensions: Chrome 25 will give you a list of the extensions it is disabling. If you want to keep some of them, you can click on “Extension Settings.” Otherwise, you can click on “OK, Great.”
Chrome 25 addresses 22 security holes (nine rated High, eight marked Medium, and five considered Low):
- [$1000] [172243] High CVE-2013-0879: Memory corruption with web audio node. Credit to Atte Kettunen of OUSPG.
- [$1000] [171951] High CVE-2013-0880: Use-after-free in database handling. Credit to Chamal de Silva.
- [$500] [167069] Medium CVE-2013-0881: Bad read in Matroska handling. Credit to Atte Kettunen of OUSPG.
- [$500] [165432] High CVE-2013-0882: Bad memory access with excessive SVG parameters. Credit to Renata Hodovan.
- [$500] [142169] Medium CVE-2013-0883: Bad read in Skia. Credit to Atte Kettunen of OUSPG.
- [172984] Low CVE-2013-0884: Inappropriate load of NaCl. Credit to Google Chrome Security Team (Chris Evans).
- [172369] Medium CVE-2013-0885: Too many API permissions granted to web store.
- [Mac only] [171569] Medium CVE-2013-0886: Incorrect NaCl signal handling. Credit to Mark Seaborn of the Chromium development community.
- [171065] [170836] Low CVE-2013-0887: Developer tools process has too many permissions and places too much trust in the connected server.
- [170666] b>Medium CVE-2013-0888: Out-of-bounds read in Skia. Credit to Google Chrome Security Team (Inferno).
- [170569] Low CVE-2013-0889: Tighten user gesture check for dangerous file downloads.
- [169973] [169966] High CVE-2013-0890: Memory safety issues across the IPC layer. Credit to Google Chrome Security Team (Chris Evans).
- [169685] High CVE-2013-0891: Integer overflow in blob handling. Credit to Google Chrome Security Team (Jüri Aedla).
- [169295] [168710] [166493] [165836] [165747] [164958] [164946] Medium CVE-2013-0892: Lower severity issues across the IPC layer. Credit to Google Chrome Security Team (Chris Evans).
- [168570] Medium CVE-2013-0893: Race condition in media handling. Credit to Andrew Scherkus of the Chromium development community.
- [168473] High CVE-2013-0894: Buffer overflow in vorbis decoding. Credit to Google Chrome Security Team (Inferno).
- [Linux / Mac] [167840] High CVE-2013-0895: Incorrect path handling in file copying. Credit to Google Chrome Security Team (Jüri Aedla).
- [166708] High CVE-2013-0896: Memory management issues in plug-in message handling. Credit to Google Chrome Security Team (Cris Neckar).
- [165537] Low CVE-2013-0897: Off-by-one read in PDF. Credit to Mateusz Jurczyk, with contributions by Gynvael Coldwind, both from Google Security Team.
- [164643] High CVE-2013-0898: Use-after-free in URL handling. Credit to Alexander Potapenko of the Chromium development community.
- [160480] Low CVE-2013-0899: Integer overflow in Opus handling. Credit to Google Chrome Security Team (Jüri Aedla).
- [152442] Medium CVE-2013-0900: Race condition in ICU. Credit to Google Chrome Security Team (Inferno).
Google thus spent a total of $3,500 in bug bounties this release. As always, these issues alone should be enough to get you to upgrade to Chrome 25.
Source: The Next Web
