PT-2021-3647 · Google+2 · Google Chrome+2

Published 2021-07-20 · Updated 2021-12-08 · CVE-2021-30586

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 92.0.4515.107

Description The issue is related to the use of memory after it has been freed during the handling of dialog boxes in Google Chrome on Windows. This could allow a remote attacker to gain unauthorized access to protected information by using a specially crafted malicious web page. The exploitation may involve convincing a user to install a malicious extension, potentially leading to heap corruption.

Recommendations For versions prior to 92.0.4515.107, update to version 92.0.4515.107 or later to resolve the issue. As a temporary workaround, consider avoiding the installation of extensions from untrusted sources and restricting access to potentially vulnerable dialog box handling functionality until a patch is applied.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2021-2387

ALT-PU-2021-2394

ALT-PU-2021-2409

ALT-PU-2021-2411

ALT-PU-2021-2573

ALT-PU-2021-2574

ALT-PU-2021-2627

BDU:2021-03866

CVE-2021-30586

Affected Products

Alt Linux

Astra Linux

Google Chrome

References · 28

• 🔥 https://github.com/s4eio/CVE-2021-30573-PoC-Google-Chrome · Exploit
• 🔥 https://github.com/s4e-lab/CVE-2021-30573-PoC-Google-Chrome · Exploit
• 🔥 https://github.com/s4e-io/CVE-2021-30573-PoC-Google-Chrome · Exploit
• 🔥 https://github.com/onsecuredev/CVE-2021-30573 · Exploit
• 🔥 https://github.com/orangmuda/CVE-2021-30573 · Exploit
• 🔥 https://github.com/byteofjoshua/CVE-2021-30573 · Exploit
• 🔥 https://github.com/rakhanobe/CVE-2021-30573 · Exploit
• 🔥 https://github.com/thomsdev/CVE-2021-30573 · Exploit
• 🔥 https://github.com/byteofandri/CVE-2021-30573 · Exploit
• 🔥 https://github.com/oxctdev/CVE-2021-30573 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-30586 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-30586 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-30586 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-30586 · Vendor Advisory