PT-2021-5258 · Google+3 · Google Chrome+3

Dhirajkumarnifty · Published 2021-03-08 · Updated 2024-06-15 · CVE-2021-21186

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome on iOS versions prior to 89.0.4389.72

Description The issue is related to insufficient policy enforcement in the QR scanning function of Google Chrome on iOS, which can be exploited by an attacker to bypass navigation restrictions. This can be achieved by convincing the user to scan a crafted QR code, allowing the attacker to circumvent existing access controls.

Recommendations For Google Chrome on iOS versions prior to 89.0.4389.72, update to version 89.0.4389.72 or later to resolve the issue. As a temporary workaround, consider restricting the use of the QR scanning function until the update is applied. Avoid scanning QR codes from untrusted sources to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

ALT-PU-2021-1460

ALT-PU-2021-1511

ALT-PU-2021-1668

ALT-PU-2021-1751

ALT-PU-2021-2141

BDU:2021-06084

CVE-2021-21186

DSA-4886-1

MGASA-2021-0142

OPENSUSE-SU-2021:0392-1

OPENSUSE-SU-2021:0401-1

OPENSUSE-SU-2021_0392-1

OPENSUSE-SU-2024:10681-1

OPENSUSE-SU-2024:12948-1

Affected Products

Alt Linux

Astra Linux

Google Chrome

Suse

References · 2353

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LCIDZ77XUDMB2EBPPWCQXPEIJERDNSNT · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21186 · Vendor Advisory
• https://debian.org/security/2021/dsa-4886 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0392-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21186 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://security.gentoo.org/glsa/202104-08 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-21186 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BBT54RKAE5XLMWSHLVUKJ7T2XHHYMXLH · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/LCIDZ77XUDMB2EBPPWCQXPEIJERDNSNT · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21186 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/FE5SIKEVYTMDCC5OSXGOM2KRPYLHYMQX · Vendor Advisory
• https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0142 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21186 · Vendor Advisory