The release of Chrome OS 121, based on the Linux kernel with the upstart system manager, ebuild/portage build tools, open-source components, and Chrome browser 121 is now available. The user environment of Chrome OS is limited to the web browser, and instead of standard applications, web applications are utilized. However, Chrome OS includes a fully functional multi-window interface, desktop, and taskbar. The source code is distributed under the Apache 2.0 free license. Chrome OS 120 is available for most current models of Chromebook. A version of Chrome OS Flex is offered for use on regular computers.
Key changes in Chrome OS 121:
- Support has been added for activating voice input using the Search + D keyboard shortcut or a separate button available on some Logitech keyboards.
- The ChromeVox screen reader can now be used to interact with applications running in App Streaming mode (which allows remote access to external Android applications, displaying the smartphone interface in a separate window).
- On the first launch, Google Assistant no longer displays welcome messages to the user.
- A new gesture has been added that allows users to close pop-up notifications using the touchpad.
- Support for marginless print output mode has been added, which can be used, for example, for printing photos that occupy the entire space of photo paper.
- Support for devices HP Compaq 6005 Pro, HP Compaq Elite 8100, Lenovo ThinkCentre M77, HP ProBook 6550b, HP 630, and Dell Optiplex 980 has been discontinued in ChromeOS Flex.
- Seven vulnerabilities have been fixed, six of which have been assigned a medium severity level:
- Vulnerabilities CVE-2024-25556, CVE-2024-1280, and CVE-2024-1281 lead to data being written beyond the allocated buffer and affect the CAMX driver, the cam_lrme_mgr_hw_prepare_update function, and the PhysmemCreateNewDmaBufBackedPMR function.
- The CVE-2024-25557 vulnerability is caused by accessing already freed physical memory pages (Physical Pages use-after-free) on the GPU PowerVR side, allowing reading and writing to physical memory from user space.
- The CVE-2024-25558 vulnerability is due to an integer overflow in the GPU PowerVR driver, which allows data to be written to an area outside the buffer boundaries.
- CVE-2023-6817 and CVE-2023-6932 are vulnerabilities in the Linux kernel.
- A vulnerability (currently without a CVE, assigned a high danger level) in the Ash window manager, caused by accessing memory after it has been freed.
Source: opennet.ru
