A release of the Chrome OS 121 operating system is available, based on the Linux kernel, the upstart system manager, the ebuild / portage assembly tool, open components and the Chrome 121 web browser. The Chrome OS user environment is limited to a web browser, and web applications are involved instead of standard programs, however, Chrome OS includes a full multi-window interface, desktop and taskbar. The source texts are distributed under the Apache 2.0 free license. Chrome OS build 120 is available for most current Chromebook models. Chrome OS Flex edition is offered for use on regular computers.
Key changes in Chrome OS 121:
- Added support for activating voice input using the Search + D keyboard shortcut or a separate button, which is available on some Logitech keyboards.
- It is possible to use the ChromeVox screen reader to interact with applications running in App Streaming mode (allows you to remotely work with external Android applications for which the smartphone interface is displayed in a separate window).
- When Google Assistant is launched for the first time, it stops showing welcome messages to the user.
- Added a new control gesture that allows you to close pop-up notifications using the touchpad.
- Added support for borderless printing mode, which, for example, can be used to print photographs that take up all the space on photo paper.
- ChromeOS Flex no longer supports the HP Compaq 6005 Pro, HP Compaq Elite 8100, Lenovo ThinkCentre M77, HP ProBook 6550b, HP 630, and Dell Optiplex 980 devices.
- 7 vulnerabilities have been fixed, 6 of which are assigned a medium severity level:
- Vulnerabilities CVE-2024-25556, CVE-2024-1280, and CVE-2024-1281 result in out-of-bounds buffer writes and affect the CAMX driver, the cam_lrme_mgr_hw_prepare_update function, and the PhysmemCreateNewDmaBufBackedPMR function.
- The vulnerability CVE-2024-25557 is caused by access to already freed pages of physical memory (Physical Pages use-after-free) on the PowerVR GPU side and allows reading and writing to physical memory from user space.
- CVE-2024-25558 is an integer overflow vulnerability in the PowerVR GPU driver that allows data to be written to an out-of-bounds buffer area.
- CVE-2023-6817 and CVE-2023-6932 are vulnerabilities in the Linux kernel.
- Vulnerability (no CVE yet, assigned a high severity level) in the Ash window manager, caused by accessing memory after it has been freed.
Source: opennet.ru