About Apple security updates
- Google Chrome Flickering Mac High Sierra
- Google Chrome For High Sierra Download
- Google Chrome Freeze Mac High Sierra
For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are available. Recent releases are listed on the Apple security updates page.
For more information about security, see the Apple Product Security page. You can encrypt communications with Apple using the Apple Product Security PGP Key.
I just have the same issue with you. I upgraded to MacOs Sierra and downloaded chrome.dmg. Everything is good but after the installation, chrome browser keeps crashing. I cannot open it. The icon shows up on the dock jus for less 1 second and it quit, disappear from the dock.i don't why. Google Chrome is the solution that over 63% of the world turns to and with good reason. Mac users have distinguished taste and as such, expect high quality in their hardware and software products. Google Chrome delivers this to Mac users with its low CPU usage, reliability, and overall browsing experience. Dark mode comes to Google Chrome on MacOS. Google brings 2019's trendiest mode to its Mac browser. March 13, 2019 10:13 a.m. Apple's next iOS update. Google Chrome in all its versions was the undeniable king of browsers. It's still a great option and a trusty reliable if you need a browser for an Android phone. If we sound a little less than enthusiastic, however, it's probably because there are 2 little points that steal some of the shine.
Apple security documents reference vulnerabilities by CVE-ID when possible.
macOS High Sierra 10.13
Released September 25, 2017
802.1X
Available for: OS X Mountain Lion 10.8 and later
Impact: An attacker may be able to exploit weaknesses in TLS 1.0
Description: A protocol security issue was addressed by enabling TLS 1.1 and TLS 1.2.
CVE-2017-13832: Doug Wussler of Florida State University
Entry added October 31, 2017, updated November 10, 2017
apache
Available for: OS X Mountain Lion 10.8 and later
Impact: Multiple issues in Apache
Description: Multiple issues existed in Apache. These were addressed by updating Apache to version 2.4.25.
CVE-2016-0736
CVE-2016-2161
CVE-2016-5387
CVE-2016-8740
CVE-2016-8743
Entry added October 31, 2017, updated December 14, 2018
Apple Account Settings
Available for: OS X Mountain Lion 10.8 and later
Impact: A local attacker may gain access to iCloud authentication tokens
Description: An issue existed in the storage of sensitive tokens. This issue was addressed by placing the tokens in Keychain.
CVE-2017-13909: Andreas Nilsson
Entry added October 18, 2018
AppleScript
Available for: OS X Mountain Lion 10.8 and later
Impact: Decompiling an AppleScript with osadecompile may lead to arbitrary code execution
Description: A validation issue was addressed with improved input sanitization.
CVE-2017-13809: bat0s
Entry added October 31, 2017, updated November 10, 2017
Application Firewall
Available for: OS X Mountain Lion 10.8 and later
Impact: A previously denied application firewall setting may take effect after upgrading
Description: An upgrade issue existed in the handling of firewall settings. This issue was addressed through improved handling of firewall settings during upgrades.
CVE-2017-7084: an anonymous researcher
AppSandbox
Available for: OS X Mountain Lion 10.8 and later
Impact: An application may be able to cause a denial of service
Description: Multiple denial of service issues were addressed through improved memory handling.
CVE-2017-7074: Daniel Jalkut of Red Sweater Software
ATS
Available for: OS X Mountain Lion 10.8 and later
Impact: Processing a maliciously crafted font may result in the disclosure of process memory
Description: A memory corruption issue was addressed with improved input validation.
CVE-2017-13820: John Villamil, Doyensec
Entry added October 31, 2017
Audio
Available for: OS X Mountain Lion 10.8 and later
Impact: Parsing a maliciously crafted QuickTime file may lead to an unexpected application termination or arbitrary code execution
Description: A memory consumption issue was addressed through improved memory handling.
CVE-2017-13807: Yangkang (@dnpushme) of Qihoo 360 Qex Team
Entry added October 31, 2017
Captive Network Assistant
Available for: OS X Mountain Lion 10.8 and later
Impact: A local user may unknowingly send a password unencrypted over the network
Description: The security state of the captive portal browser was not obvious. This issue was addressed with improved visibility of the captive portal browser security state.
CVE-2017-7143: Matthew Green of Johns Hopkins University
Entry updated October 3, 2017
CFNetwork
Available for: OS X Mountain Lion 10.8 and later
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-13829: Niklas Baumstark and Samuel Gro working with Trend Micro's Zero Day Initiative
CVE-2017-13833: Niklas Baumstark and Samuel Gro working with Trend Micro's Zero Day Initiative
Entry added November 10, 2017
CFNetwork Proxies
Available for: OS X Mountain Lion 10.8 and later
Impact: An attacker in a privileged network position may be able to cause a denial of service
Description: Multiple denial of service issues were addressed through improved memory handling.
CVE-2017-7083: Abhinav Bansal of Zscaler Inc.
CFString
Available for: OS X Mountain Lion 10.8 and later
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input sanitization.
CVE-2017-13821: Australian Cyber Security Centre – Australian Signals Directorate
Entry added October 31, 2017
CoreAudio
Available for: OS X Mountain Lion 10.8 and later
Impact: An application may be able to read restricted memory
Description: An out-of-bounds read was addressed by updating to Opus version 1.1.4.
CVE-2017-0381: V.E.O (@VYSEa) of Mobile Threat Research Team, Trend Micro
CoreText
Available for: OS X Mountain Lion 10.8 and later
Impact: Processing a maliciously crafted font file may lead to arbitrary code execution
Description: A memory consumption issue was addressed with improved memory handling.
CVE-2017-13825: Australian Cyber Security Centre – Australian Signals Directorate
Entry added October 31, 2017, updated November 16, 2018
CoreTypes
Available for: OS X Mountain Lion 10.8 and later
Impact: Processing a maliciously crafted webpage may result in the mounting of a disk image
Description: A logic issue was addressed with improved restrictions.
CVE-2017-13890: Apple, Theodor Ragnar Gislason of Syndis
Entry added March 29, 2018
DesktopServices
Available for: OS X Mountain Lion 10.8 and later
Impact: A local attacker may be able to observe unprotected user data
Description: A file access issue existed with certain home folder files. This was addressed with improved access restrictions.
CVE-2017-13851: Henrique Correa de Amorim
Entry added November 2, 2017, updated February 14, 2018
Directory Utility
Available for: OS X Mountain Lion 10.8 and later
Impact: A local attacker may be able to determine the Apple ID of the owner of the computer
Description: A permissions issue existed in the handling of the Apple ID. This issue was addressed with improved access controls.
CVE-2017-7138: Daniel Kvak of Masaryk University
Entry updated October 3, 2017
file
Available for: OS X Mountain Lion 10.8 and later
Impact: Multiple issues in file
Description: Multiple issues were addressed by updating to version 5.30.
CVE-2017-7121: found by OSS-Fuzz
CVE-2017-7122: found by OSS-Fuzz
CVE-2017-7123: found by OSS-Fuzz
CVE-2017-7124: found by OSS-Fuzz
CVE-2017-7125: found by OSS-Fuzz
CVE-2017-7126: found by OSS-Fuzz
file
Available for: OS X Mountain Lion 10.8 and later
Impact: Multiple issues in file
Description: Multiple issues were addressed by updating to version 5.31.
CVE-2017-13815
Entry added October 31, 2017
Fonts
Available for: OS X Mountain Lion 10.8 and later
Impact: Rendering untrusted text may lead to spoofing
Description: An inconsistent user interface issue was addressed with improved state management.
CVE-2017-13828: Leonard Grey and Robert Sesek of Google Chrome
Entry added October 31, 2017, updated November 10, 2017
fsck_msdos
Available for: OS X Mountain Lion 10.8 and later
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-13811: V.E.O. (@VYSEa) of Mobile Advanced Threat Team of Trend Micro
Entry updated November 2, 2017
fsck_msdos
Available for: OS X Mountain Lion 10.8 and later
Impact: An application may be able to execute arbitrary code with elevated privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-13835: an anonymous researcher
Entry added October 18, 2018
Heimdal
Available for: OS X Mountain Lion 10.8 and later
Impact: An attacker in a privileged network position may be able to impersonate a service
Description: A validation issue existed in the handling of the KDC-REP service name. This issue was addressed through improved validation.
CVE-2017-11103: Jeffrey Altman, Viktor Duchovni, and Nico Williams
HelpViewer
Available for: OS X Mountain Lion 10.8 and later
Impact: A quarantined HTML file may execute arbitrary JavaScript cross-origin
Description: A cross-site scripting issue existed in HelpViewer. This issue was addressed by removing the affected file.
CVE-2017-13819: Filippo Cavallarin of SecuriTeam Secure Disclosure
Entry added October 31, 2017, updated November 10, 2017
HFS
Available for: OS X Mountain Lion 10.8 and later
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-13830: Sergej Schumilo of Ruhr-University Bochum
Entry added October 31, 2017
Download nano shout software mac. ImageIO
Available for: OS X Mountain Lion 10.8 and later
Impact: Processing a maliciously crafted image may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved input validation.
CVE-2017-13814: Australian Cyber Security Centre – Australian Signals Directorate
Entry added October 31, 2017, updated November 16, 2018
ImageIO
Available for: OS X Mountain Lion 10.8 and later
Impact: Processing a maliciously crafted image may lead to a denial of service
Description: A memory corruption issue was addressed with improved input validation.
CVE-2017-13831: Glen Carmichael
Entry added October 31, 2017, updated April 3, 2019
Installer
Available for: OS X Mountain Lion 10.8 and later
Impact: A malicious application may be able to access the FileVault unlock key
Description: This issue was addressed by removing additional entitlements.
CVE-2017-13837: Patrick Wardle of Synack
Entry added October 31, 2017, updated November 10, 2017
IOAcceleratorFamily
Available for: OS X Mountain Lion 10.8 and later
Impact: A malicious application may be able to elevate privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-13906
Entry added October 18, 2018
IOFireWireFamily
Available for: OS X Mountain Lion 10.8 and later
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-7077: Brandon Azad
IOFireWireFamily
Available for: OS X Mountain Lion 10.8 and later
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input sanitization.
CVE-2017-7119: Xiaolong Bai, Min (Spark) Zheng of Alibaba Inc., Benjamin Gnahm (@mitp0sh) of PDX
Kernel
Available for: OS X Mountain Lion 10.8 and later
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-7114: Alex Plaskett of MWR InfoSecurity
Kernel
Available for: OS X Mountain Lion 10.8 and later
Impact: A local user may be able to leak sensitive user information
Description: A permissions issue existed in kernel packet counters. This issue was addressed through improved permission validation.
CVE-2017-13810: Zhiyun Qian of University of California, Riverside
Entry added October 31, 2017, updated November 10, 2017
Kernel
Available for: OS X Mountain Lion 10.8 and later
Impact: A local user may be able to read kernel memory
Description: An out-of-bounds read issue existed that led to the disclosure of kernel memory. This was addressed through improved input validation.
CVE-2017-13817: Maxime Villard (m00nbsd)
Entry added October 31, 2017
Kernel
Available for: OS X Mountain Lion 10.8 and later
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input sanitization.
CVE-2017-13818: The UK's National Cyber Security Centre (NCSC)
CVE-2017-13836: Vlad Tsyrklevich
CVE-2017-13841: Vlad Tsyrklevich
CVE-2017-13840: Vlad Tsyrklevich
CVE-2017-13842: Vlad Tsyrklevich
CVE-2017-13782: Kevin Backhouse of Semmle Ltd.
Entry added October 31, 2017, updated June 18, 2018
Kernel
Available for: OS X Mountain Lion 10.8 and later
Impact: An application may be able to execute arbitrary code with kernel privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-13843: an anonymous researcher, an anonymous researcher
Entry added October 31, 2017
Kernel
Available for: OS X Mountain Lion 10.8 and later
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-13854: shrek_wzw of Qihoo 360 Nirvan Team
Entry added November 2, 2017
Kernel
Available for: OS X Mountain Lion 10.8 and later
Impact: Processing a malformed mach binary may lead to arbitrary code execution
Description: A memory corruption issue was addressed through improved validation.
CVE-2017-13834: Maxime Villard (m00nbsd)
Entry added November 10, 2017
Kernel
Available for: OS X Mountain Lion 10.8 and later
Impact: A malicious application may be able to learn information about the presence and operation of other applications on the device.
Description: An application was able to access network activity information maintained by the operating system unrestricted. This issue was addressed by reducing the information available to third party applications.
CVE-2017-13873: Xiaokuan Zhang and Yinqian Zhang of The Ohio State University, Xueqiang Wang and XiaoFeng Wang of Indiana University Bloomington, and Xiaolong Bai of Tsinghua University
Entry added November 30, 2017
kext tools
Available for: OS X Mountain Lion 10.8 and later
Impact: An application may be able to execute arbitrary code with system privileges
Description: A logic error in kext loading was addressed with improved state handling.
CVE-2017-13827: an anonymous researcher
Entry added October 31, 2017
libarchive
Available for: OS X Mountain Lion 10.8 and later
Impact: Unpacking a maliciously crafted archive may lead to arbitrary code execution
Description: A buffer overflow issue was addressed through improved memory handling.
CVE-2017-13813: found by OSS-Fuzz
CVE-2017-13816: found by OSS-Fuzz
Entry added October 31, 2017
libarchive
Available for: OS X Mountain Lion 10.8 and later
Impact: Unpacking a maliciously crafted archive may lead to arbitrary code execution
Description: Multiple memory corruption issues existed in libarchive. These issues were addressed through improved input validation.
CVE-2017-13812: found by OSS-Fuzz
Entry added October 31, 2017
libarchive
Available for: OS X Mountain Lion 10.8 and later
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input sanitization.
CVE-2016-4736: an anonymous researcher
Entry added October 31, 2017
libc
Available for: OS X Mountain Lion 10.8 and later
Impact: A remote attacker may be able to cause a denial-of-service
Description: A resource exhaustion issue in glob() was addressed through an improved algorithm.
CVE-2017-7086: Russ Cox of Google
libc
Available for: OS X Mountain Lion 10.8 and later
Impact: An application may be able to cause a denial of service
Description: A memory consumption issue was addressed through improved memory handling.
CVE-2017-1000373
libexpat
Available for: OS X Mountain Lion 10.8 and later
Impact: Multiple issues in expat
Description: Multiple issues were addressed by updating to version 2.2.1
CVE-2016-9063
CVE-2017-9233
libxml2
Available for: OS X Mountain Lion 10.8 and later
Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution
Description: A null pointer dereference was addressed with improved validation.
CVE-2018-4302: Gustavo Grieco
Entry added October 18, 2018
libxml2
Available for: OS X Mountain Lion 10.8 and later
Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution
Description: A buffer overflow issue was addressed with improved memory handling.
CVE-2017-5130: an anonymous researcher
CVE-2017-7376: an anonymous researcher
Entry added October 18, 2018
libxml2
Available for: OS X Mountain Lion 10.8 and later
Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution
Description: A memory corruption issue was addressed with improved input validation.
CVE-2017-9050: Mateusz Jurczyk (j00ru) of Google Project Zero
Entry added October 18, 2018
libxml2
Available for: OS X Mountain Lion 10.8 and later
Impact: Processing maliciously crafted XML may lead to an unexpected application termination or arbitrary code execution
Description: A use after free issue was addressed with improved memory management.
CVE-2017-9049: Wei Lei and Liu Yang - Nanyang Technological University in Singapore
Entry added October 18, 2018
Available for: OS X Mountain Lion 10.8 and later
Impact: The sender of an email may be able to determine the IP address of the recipient
Description: Turning off 'Load remote content in messages' did not apply to all mailboxes. This issue was addressed with improved setting propagation.
CVE-2017-7141: John Whitehead of The New York Times
Entry updated October 3, 2017
Mail Drafts
Available for: OS X Mountain Lion 10.8 and later
Impact: An attacker with a privileged network position may be able to intercept mail contents
Description: An encryption issue existed in the handling of mail drafts. This issue was addressed with improved handling of mail drafts meant to be sent encrypted.
CVE-2017-7078: Petter Flink, Pierre ALBARÈDE from Marseille (France), an anonymous researcher
Entry updated October 3, 2017
ntp
Available for: OS X Mountain Lion 10.8 and later
Impact: Multiple issues in ntp
Description: Multiple issues were addressed by updating to version 4.2.8p10
CVE-2017-6451: Cure53
CVE-2017-6452: Cure53
CVE-2017-6455: Cure53
CVE-2017-6458: Cure53
CVE-2017-6459: Cure53
CVE-2017-6460: Cure53
CVE-2017-6462: Cure53
CVE-2017-6463: Cure53
CVE-2017-6464: Cure53
CVE-2016-9042: Matthew Van Gundy of Cisco
Open Scripting Architecture
Available for: OS X Mountain Lion 10.8 and later
Impact: Decompiling an AppleScript with osadecompile may lead to arbitrary code execution
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-13824: an anonymous researcher
Entry added October 31, 2017
PCRE
Available for: OS X Mountain Lion 10.8 and later
Impact: Multiple issues in pcre
Description: Multiple issues were addressed by updating to version 8.40.
CVE-2017-13846
Entry added October 31, 2017
Postfix
Available for: OS X Mountain Lion 10.8 and later
Impact: Multiple issues in Postfix
Description: Multiple issues were addressed by updating to version 3.2.2.
CVE-2017-10140: an anonymous researcher
Entry added October 31, 2017, updated November 17, 2017
Quick Look
Available for: OS X Mountain Lion 10.8 and later
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input sanitization.
CVE-2017-13822: Australian Cyber Security Centre – Australian Signals Directorate
Entry added October 31, 2017
Quick Look
Available for: OS X Mountain Lion 10.8 and later
Impact: Parsing a maliciously crafted office document may lead to an unexpected application termination or arbitrary code execution
Description: A memory consumption issue was addressed through improved memory handling.
CVE-2017-7132: Australian Cyber Security Centre – Australian Signals Directorate
Entry added October 31, 2017
QuickTime
Available for: OS X Mountain Lion 10.8 and later
Impact: An application may be able to read restricted memory
Description: A validation issue was addressed with improved input sanitization.
CVE-2017-13823: Xiangkun Jia of Institute of Software Chinese Academy of Sciences
Entry added October 31, 2017, updated November 10, 2017
Remote Management
Available for: OS X Mountain Lion 10.8 and later
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-13808: an anonymous researcher
Entry added October 31, 2017
Sandbox
Available for: OS X Mountain Lion 10.8 and later
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-13838: Alastair Houghton
Entry added October 31, 2017, updated November 10, 2017
Screen Lock
Available for: OS X Mountain Lion 10.8 and later
Impact: Application Firewall prompts may appear over Login Window
Description: A window management issue was addressed through improved state management.
CVE-2017-7082: Tim Kingman
Security
Available for: OS X Mountain Lion 10.8 and later
Impact: A revoked certificate may be trusted
Description: A certificate validation issue existed in the handling of revocation data. This issue was addressed through improved validation.
CVE-2017-7080: Sven Driemecker of adesso mobile solutions gmbh, Rune Darrud (@theflyingcorpse) of Bærum kommune, an anonymous researcher, an anonymous researcher
SMB
Available for: OS X Mountain Lion 10.8 and later
Impact: A local attacker may be able to execute non-executable text files via an SMB share
Description: An issue in handling file permissions was addressed with improved validation.
CVE-2017-13908: an anonymous researcher
Entry added October 18, 2018
Spotlight
Available for: OS X Mountain Lion 10.8 and later
Impact: Spotlight may display results for files not belonging to the user
Description: An access issue existed in Spotlight. This issue was addressed through improved access restrictions.
CVE-2017-13839: Ken Harris of the Free Robot Collective
Entry added October 31, 2017, updated November 10, 2017
Spotlight
Available for: OS X Mountain Lion 10.8 and later
Impact: An application may be able to access restricted files
Description: An access issue was addressed with additional sandbox restrictions on applications.
CVE-2017-13910
Entry added October 18, 2018
SQLite
Available for: OS X Mountain Lion 10.8 and later
Impact: Multiple issues in SQLite
Description: Multiple issues were addressed by updating to version 3.19.3.
CVE-2017-10989: found by OSS-Fuzz
CVE-2017-7128: found by OSS-Fuzz
CVE-2017-7129: found by OSS-Fuzz
CVE-2017-7130: found by OSS-Fuzz
SQLite
Available for: OS X Mountain Lion 10.8 and later
Impact: An application may be able to execute arbitrary code with system privileges
Description: A memory corruption issue was addressed with improved memory handling.
CVE-2017-7127: an anonymous researcher
zlib
Google Chrome Flickering Mac High Sierra
Available for: OS X Mountain Lion 10.8 and later
Impact: Multiple issues in zlib
Description: Multiple issues were addressed by updating to version 1.2.11.
CVE-2016-9840
CVE-2016-9841
CVE-2016-9842
CVE-2016-9843
Additional recognition
We would like to acknowledge Jon Bottarini of HackerOne for their assistance.
Entry added February 6, 2020
Security
We would like to acknowledge Abhinav Bansal of Zscaler, Inc. for their assistance.
NSWindow
Google Chrome For High Sierra Download
We would like to acknowledge Trent Apted of the Google Chrome team for their assistance.
WebKit Web Inspector
Google Chrome Freeze Mac High Sierra
We would like to acknowledge Ioan Bizău of Bloggify for their assistance.
macOS High Sierra 10.13 Supplemental Update
New downloads of macOS High Sierra 10.13 include the security content of the macOS High Sierra 10.13 Supplemental Update.