PT-2021-3768 · Google+3 · Google Chrome+3

David Erceg · Published 2021-07-20 · Updated 2024-06-15 · CVE-2021-30565

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 92.0.4515.107

Description The issue is related to an out of bounds write in Tab Groups in Google Chrome on Linux and ChromeOS. This could allow an attacker, who convinced a user to install a malicious extension, to perform an out of bounds memory write via a crafted HTML page. The attacker must be able to convince the user to install the malicious extension to exploit this issue.

Recommendations For versions prior to 92.0.4515.107, update to version 92.0.4515.107 or later to resolve the issue. As a temporary workaround, consider disabling the use of Tab Groups until a patch is available. Restrict access to installing extensions to minimize the risk of exploitation. Avoid using crafted HTML pages in the affected Google Chrome versions until the issue is resolved.

Exploit

Fix

Code Injection

Memory Corruption

Weakness Enumeration

CWE-94

CWE-787

Related Identifiers

ALT-PU-2021-2387

ALT-PU-2021-2394

ALT-PU-2021-2409

ALT-PU-2021-2411

ALT-PU-2021-2573

ALT-PU-2021-2574

ALT-PU-2021-2627

BDU:2021-04024

CVE-2021-30565

OPENSUSE-SU-2021:1131-1

OPENSUSE-SU-2021:1144-1

OPENSUSE-SU-2021_1131-1

OPENSUSE-SU-2024:10681-1

OPENSUSE-SU-2024:12948-1

Affected Products

Alt Linux

Astra Linux

Google Chrome

Suse

References · 2338

• 🔥 https://crbug.com/1210985 · Exploit
• https://chromereleases.googleblog.com/2021/07/stable-channel-update-for-desktop_20.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04024 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5LVY4WIWTVVYKQMROJJS365TZBKEARCF · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IPJPUSAWIJMQFBQQQYXAICLI4EKFQOH6 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-30565 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:1131-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-30565 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-30565 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-30565 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2021-1126SE17 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-30565 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-30565 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-0114SE47 · Vendor Advisory