PT-2021-4469 · Google+3 · Google Chrome+3
Published
2021-08-31
·
Updated
2024-06-15
·
CVE-2021-30618
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Google Chrome versions prior to 93.0.4577.63
Description
The issue is related to inappropriate implementation in DevTools, which can be exploited by a remote attacker to gain unauthorized access to protected information or cause a denial of service. A remote attacker who convinces the user to use Chrome headless with remote debugging can execute arbitrary code via a crafted HTML page.
Recommendations
For Google Chrome versions prior to 93.0.4577.63, update to version 93.0.4577.63 or later to resolve the issue. As a temporary workaround, consider disabling the use of Chrome headless with remote debugging until a patch is available. Restrict access to DevTools to minimize the risk of exploitation. Avoid using crafted HTML pages in the affected browser version until the issue is resolved.
Exploit
Fix
Improperly Implemented Security Check for Standard
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Astra Linux
Google Chrome
Suse