PT-2021-3716 · Google+3 · Google Chrome+3
David Erceg
·
Published
2021-07-20
·
Updated
2024-06-15
·
CVE-2021-30581
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 92.0.4515.107
Description
The issue is related to a use after free in DevTools, which could allow an attacker to potentially exploit heap corruption via a crafted HTML page if a user is convinced to install a malicious extension. This could lead to unauthorized access to protected information. The attacker must convince the user to install a malicious extension and then open a specially crafted HTML page to exploit the issue.
Recommendations
For Google Chrome versions prior to 92.0.4515.107, update to version 92.0.4515.107 or later to resolve the issue. As a temporary workaround, consider avoiding the installation of extensions from untrusted sources and being cautious when opening links from unknown senders. Restrict access to the DevTools component to minimize the risk of exploitation until the update is applied.
Exploit
Fix
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Google Chrome
Suse