PT-2021-7876 · Google+1 · Google Chrome+1

Austin Williams · Published 2021-05-25 · Updated 2024-07-11 · CVE-2021-4321

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 91.0.4472.77

Description The issue exists due to insufficient input validation in the Blink rendering engine of Google Chrome, allowing a remote attacker to bypass existing security restrictions. This can be achieved via a crafted HTML page, enabling the attacker to bypass content security policy. The estimated number of potentially affected devices and details about real-world incidents are not specified.

Recommendations For versions prior to 91.0.4472.77, update to version 91.0.4472.77 or later to resolve the issue. As a temporary workaround, consider restricting access to crafted HTML pages that could exploit this issue until a patch is applied. Avoid using the vulnerable Blink rendering engine for sensitive operations until the update is installed.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2023-04402

CVE-2021-4321

DSA-5046-1

Affected Products

Astra Linux

Google Chrome

References · 16

• 🔥 https://github.com/ZeusBox/CVE-2021-37980 · Exploit
• 🔥 https://github.com/SpiralBL0CK/Chrome-V8-RCE-CVE-2021-38003 · Exploit
• 🔥 https://github.com/Peterpan0927/TFC-Chrome-v8-bug-CVE-2021-38001-poc · Exploit
• 🔥 https://github.com/maldiohead/TFC-Chrome-v8-bug-CVE-2021-38001-poc · Exploit
• 🔥 https://crbug.com/1161891 · Exploit
• https://osv.dev/vulnerability/DSA-5046-1 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/PQKT7EGDD2P3L7S3NXEDDRCPK4NNZNWJ · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4321 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-4321 · Vendor Advisory
• https://chromereleases.googleblog.com/2021/05/stable-channel-update-for-desktop_25.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-4321 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04402 · Security Note
• https://osv.dev/vulnerability/CVE-2021-4321 · Vendor Advisory
• https://twitter.com/transilienceai/status/1811403082250473544 · Twitter Post
• https://twitter.com/transilienceai/status/1811221872752668994 · Twitter Post