PT-2021-2060 · Google+3 · Google Chrome+3

David Erceg · Published 2021-01-19 · Updated 2024-06-15 · CVE-2021-21126

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 88.0.4324.96

Description: The issue is related to insufficient policy enforcement in extensions, allowing a remote attacker to bypass site isolation using a crafted Chrome Extension. This can be exploited by creating a specially designed Chrome extension to circumvent existing security restrictions. The estimated number of potentially affected devices and details about real-world incidents are not provided.

Recommendations: For versions prior to 88.0.4324.96, update to version 88.0.4324.96 or later to resolve the issue. As a temporary workaround, consider restricting the installation of Chrome extensions from untrusted sources to minimize the risk of exploitation. Avoid using extensions that may bypass site isolation until the issue is resolved.

Exploit

Fix

Improper Authentication

RCE

Weakness Enumeration

CWE-287

CWE-20

Related Identifiers

ALT-PU-2021-1146

ALT-PU-2021-1179

ALT-PU-2021-1198

ALT-PU-2021-1210

ALT-PU-2021-1379

BDU:2021-00907

CVE-2021-21126

DSA-4846-1

MGASA-2021-0406

OPENSUSE-SU-2021:0166-1

OPENSUSE-SU-2021:0173-1

OPENSUSE-SU-2021:0177-1

OPENSUSE-SU-2021:0186-1

OPENSUSE-SU-2021:0973-1

OPENSUSE-SU-2021:1016-1

OPENSUSE-SU-2021_0166-1

OPENSUSE-SU-2021_0173-1

OPENSUSE-SU-2021_0973-1

OPENSUSE-SU-2024:10681-1

OPENSUSE-SU-2024:10977-1

OPENSUSE-SU-2024:12948-1

Affected Products

Alt Linux

Astra Linux

Google Chrome

Suse

References · 2361

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/chrome_simplifiedlowering_overflow.rb · Exploit
• 🔥 https://github.com/Puliczek/CVE-2021-21123-PoC-Google-Chrome · Exploit
• 🔥 https://github.com/PerimeterX/CVE-2020-6519 · Exploit
• 🔥 https://github.com/aleksejspopovs/cve-2020-16012 · Exploit
• 🔥 https://github.com/R0jhack/CVE-2020-6514 · Exploit
• 🔥 https://github.com/hasan-khalil/CVE-2020-6514 · Exploit
• 🔥 https://github.com/HassanAzze/CVE-2020-6514 · Exploit
• 🔥 https://github.com/rojhack/CVE-2020-6514 · Exploit
• 🔥❌ https://github.com/marcinguy/CVE-2020-15999 · Exploit, Deleted
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21126 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1016-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21126 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2021:0166-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10681-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21126 · Vendor Advisory