PT-2021-7875 · Google+1 · Google Chrome+1

Lbherrera + 1 · Published 2021-04-14 · Updated 2023-08-12 · CVE-2021-4323

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 90.0.4430.72

Description The issue is related to insufficient validation of untrusted input in Extensions, allowing an attacker to access local files via a crafted Chrome Extension if a user is convinced to install a malicious extension. This can lead to unauthorized access to local files. The estimated number of potentially affected devices worldwide is not specified.

Recommendations For Google Chrome versions prior to 90.0.4430.72, update to version 90.0.4430.72 or later to resolve the issue. As a temporary workaround, consider restricting the installation of extensions to only trusted sources until the update is applied.

Exploit

Fix

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2023-04391

CVE-2021-4323

DSA-4906-1

Affected Products

Astra Linux

Google Chrome

References · 10

• 🔥❌ https://github.com/ohnonoyesyes/CVE-2021-21224 · Exploit, Deleted
• 🔥 https://crbug.com/1176031 · Exploit
• https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04391 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-4323 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2021-4323 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-4323 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-4323 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4906-1 · Vendor Advisory