PT-2021-2167 · Google+3 · Google Chrome+3

Alison Huffman + 1 · Published 2021-02-02 · Updated 2024-06-15 · CVE-2021-21146

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 88.0.4324.146

Description The issue is related to a use after free in the Navigation component of Google Chrome, which could allow a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. This could impact the confidentiality, integrity, and availability of protected information.

Recommendations For versions prior to 88.0.4324.146, update to version 88.0.4324.146 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable Navigation components until a patch is applied.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2021-1204

ALT-PU-2021-1238

ALT-PU-2021-1252

ALT-PU-2021-1253

ALT-PU-2021-1379

BDU:2021-01065

CVE-2021-21146

DSA-4846-1

MGASA-2021-0406

OPENSUSE-SU-2021:0259-1

OPENSUSE-SU-2021:0268-1

OPENSUSE-SU-2021:0973-1

OPENSUSE-SU-2021:1016-1

OPENSUSE-SU-2021_0259-1

OPENSUSE-SU-2021_0973-1

OPENSUSE-SU-2024:10681-1

OPENSUSE-SU-2024:10977-1

OPENSUSE-SU-2024:12948-1

Affected Products

Alt Linux

Astra Linux

Google Chrome

Suse

References · 2365

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/chrome_simplifiedlowering_overflow.rb · Exploit
• 🔥 https://github.com/Puliczek/CVE-2021-21123-PoC-Google-Chrome · Exploit
• 🔥 https://github.com/PerimeterX/CVE-2020-6519 · Exploit
• 🔥 https://github.com/aleksejspopovs/cve-2020-16012 · Exploit
• 🔥 https://github.com/R0jhack/CVE-2020-6514 · Exploit
• 🔥 https://github.com/hasan-khalil/CVE-2020-6514 · Exploit
• 🔥 https://github.com/HassanAzze/CVE-2020-6514 · Exploit
• 🔥 https://github.com/rojhack/CVE-2020-6514 · Exploit
• 🔥❌ https://github.com/marcinguy/CVE-2020-15999 · Exploit, Deleted
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21146 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-21146 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1016-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21146 · Security Note
• https://ubuntu.com/security/CVE-2021-21146 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10681-1 · Vendor Advisory