Please see the Chromium security page for more detail. Note that the referenced bugs may be kept private until a majority of our users are up to date with the fix.

• [72189] Low CVE-2011-1801: Pop-up blocker bypass. Credit to Chamal De Silva.
• [$1000] [82546] High CVE-2011-1804: Stale pointer in floats rendering. Credit to Martin Barbella.
• [82873] Critical CVE-2011-1806: Memory corruption in GPU command buffer. Credit to Google Chrome Security Team (Cris Neckar).
• [82903] Critical CVE-2011-1807: Out-of-bounds write in blob handling. Credit to Google Chrome Security Team (Inferno) and Kostya Serebryany of the Chromium development community.

The following bugs were fixed:

• REGRESSION: selection extended by arrow keys flickers on LinkedIn.com. (Issue 83197).
• Have ConnectBackupJob try IPv4 first to hide potential long IPv6 connect timeout (Issue 81686).
• Mac plugin crashes are too low in stats (Issue 82172).
• Incorrect ACLs on the archived copy of setup.exe (Issue 82424)