PT-2021-5636 · Google+3 · Google Chrome+3

Ayush Agarwal + 5 · Published 2021-09-21 · Updated 2024-06-15 · CVE-2021-37963

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 94.0.4606.54

Description The issue is related to side-channel information leakage in DevTools, allowing a remote attacker to bypass site isolation via a crafted HTML page. This is due to errors in data encryption. The attacker can exploit this issue to bypass existing security restrictions.

Recommendations For versions prior to 94.0.4606.54, update to version 94.0.4606.54 or later to resolve the issue. As a temporary workaround, consider restricting access to DevTools or avoiding the use of crafted HTML pages that could exploit this issue.

Exploit

Fix

Weakness Enumeration

CWE-310

Related Identifiers

ALT-PU-2021-2909

ALT-PU-2021-2987

ALT-PU-2021-2988

ALT-PU-2021-3044

ALT-PU-2021-3050

ALT-PU-2021-3436

ALT-PU-2021-3603

BDU:2022-00074

CVE-2021-37963

DSA-5046-1

OPENSUSE-SU-2021:1339-1

OPENSUSE-SU-2021:1350-1

OPENSUSE-SU-2021_1350-1

OPENSUSE-SU-2024:11555-1

OPENSUSE-SU-2024:12948-1

Affected Products

Alt Linux

Astra Linux

Google Chrome

Suse

References · 2354

• 🔥 https://github.com/Phuong39/PoC-CVE-2021-30632 · Exploit
• 🔥 https://github.com/ZeusBox/CVE-2021-37980 · Exploit
• 🔥 https://github.com/SpiralBL0CK/Chrome-V8-RCE-CVE-2021-38003 · Exploit
• 🔥 https://github.com/CrackerCat/CVE-2021-30632 · Exploit
• 🔥 https://github.com/Peterpan0927/TFC-Chrome-v8-bug-CVE-2021-38001-poc · Exploit
• 🔥 https://github.com/maldiohead/TFC-Chrome-v8-bug-CVE-2021-38001-poc · Exploit
• 🔥❌ https://github.com/Lagal1990/CVE-2021-30632 · Exploit, Deleted
• 🔥❌ https://github.com/Expdev893/CVE-2021-30632 · Exploit, Deleted
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-37963 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-37963 · Vendor Advisory
• https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_21.html · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PM7MOYYHJSWLIFZ4TPJTD7MSA3HSSLV2 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-37963 · Security Note
• https://ubuntu.com/security/CVE-2021-37963 · Vendor Advisory