Potential user after free in Speech Recognizer in Google Chrome on Android prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2020-16044     Ned Williamson discovered a use-after-free issue in the     WebRTC implementation.

  - CVE-2021-21117     Rory McNamara discovered a policy enforcement issue in     Cryptohome.

  - CVE-2021-21118     Tyler Nighswander discovered a data validation issue in     the v8 JavaScript library.

  - CVE-2021-21119     A use-after-free issue was discovered in media handling.

  - CVE-2021-21120     Nan Wang and Guang Gong discovered a use-after-free     issue in the WebSQL implementation.

  - CVE-2021-21121     Leecraso and Guang Gong discovered a use-after-free     issue in the Omnibox.

  - CVE-2021-21122     Renata Hodovan discovered a use-after-free issue in     Blink/WebKit.

  - CVE-2021-21123     Maciej Pulikowski discovered a data validation issue.

  - CVE-2021-21124     Chaoyang Ding discovered a use-after-free issue in the     speech recognizer.

  - CVE-2021-21125     Ron Masas discovered a policy enforcement issue.

  - CVE-2021-21126     David Erceg discovered a policy enforcement issue in     extensions.

  - CVE-2021-21127     Jasminder Pal Singh discovered a policy enforcement     issue in extensions.

  - CVE-2021-21128     Liang Dong discovered a buffer overflow issue in     Blink/WebKit.

  - CVE-2021-21129     Maciej Pulikowski discovered a policy enforcement issue.

  - CVE-2021-21130     Maciej Pulikowski discovered a policy enforcement issue.

  - CVE-2021-21131     Maciej Pulikowski discovered a policy enforcement issue.

  - CVE-2021-21132     David Erceg discovered an implementation error in the     developer tools.

  - CVE-2021-21133     wester0x01 discovered a policy enforcement issue.

  - CVE-2021-21134     wester0x01 discovered a user interface error.

  - CVE-2021-21135     ndevtk discovered an implementation error in the     Performance API.

  - CVE-2021-21136     Shiv Sahni, Movnavinothan V, and Imdad Mohammed     discovered a policy enforcement error.

  - CVE-2021-21137     bobbybear discovered an implementation error in the     developer tools.

  - CVE-2021-21138     Weipeng Jiang discovered a use-after-free issue in the     developer tools.

  - CVE-2021-21139     Jun Kokatsu discovered an implementation error in the     iframe sandbox.

  - CVE-2021-21140     David Manouchehri discovered uninitialized memory in the     USB implementation.

  - CVE-2021-21141     Maciej Pulikowski discovered a policy enforcement error.

  - CVE-2021-21142     Khalil Zhani discovered a use-after-free issue.

  - CVE-2021-21143     Allen Parker and Alex Morgan discovered a buffer     overflow issue in extensions.

  - CVE-2021-21144     Leecraso and Guang Gong discovered a buffer overflow     issue.

  - CVE-2021-21145     A use-after-free issue was discovered.

  - CVE-2021-21146     Alison Huffman and Choongwoo Han discovered a     use-after-free issue.

  - CVE-2021-21147     Roman Starkov discovered an implementation error in the     skia library.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-b7cc24375b advisory.

  - Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially     exploit heap corruption via a crafted SCTP packet. (CVE-2020-16044)

  - Insufficient policy enforcement in Cryptohome in Google Chrome prior to 88.0.4324.96 allowed a local     attacker to perform OS-level privilege escalation via a crafted file. (CVE-2021-21117)

  - Insufficient data validation in V8 in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to     potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-21118)

  - Use after free in Media in Google Chrome prior to 88.0.4324.96 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2021-21119)

  - Use after free in WebSQL in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21120)

  - Use after free in Omnibox in Google Chrome on Linux prior to 88.0.4324.96 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (CVE-2021-21121)

  - Use after free in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21122)

  - Insufficient data validation in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass filesystem restrictions via a crafted HTML page. (CVE-2021-21123)

  - Potential user after free in Speech Recognizer in Google Chrome on Android prior to 88.0.4324.96 allowed a     remote attacker to potentially perform a sandbox escape via a crafted HTML page. (CVE-2021-21124)

  - Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 88.0.4324.96     allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (CVE-2021-21125)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass site isolation via a crafted Chrome Extension. (CVE-2021-21126)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass content security policy via a crafted Chrome Extension. (CVE-2021-21127)

  - Heap buffer overflow in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21128)

  - Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass filesystem restrictions via a crafted HTML page. (CVE-2021-21129, CVE-2021-21130,     CVE-2021-21131)

  - Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker     to potentially perform a sandbox escape via a crafted Chrome Extension. (CVE-2021-21132)

  - Insufficient policy enforcement in Downloads in Google Chrome prior to 88.0.4324.96 allowed an attacker     who convinced a user to download files to bypass navigation restrictions via a crafted HTML page.
    (CVE-2021-21133)

  - Incorrect security UI in Page Info in Google Chrome on iOS prior to 88.0.4324.96 allowed a remote attacker     to spoof security UI via a crafted HTML page. (CVE-2021-21134)

  - Inappropriate implementation in Performance API in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21135)

  - Insufficient policy enforcement in WebView in Google Chrome on Android prior to 88.0.4324.96 allowed a     remote attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21136)

  - Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker     to obtain potentially sensitive information from disk via a crafted HTML page. (CVE-2021-21137)

  - Use after free in DevTools in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially     perform a sandbox escape via a crafted file. (CVE-2021-21138)

  - Inappropriate implementation in iframe sandbox in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass navigation restrictions via a crafted HTML page. (CVE-2021-21139)

  - Uninitialized use in USB in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially     perform out of bounds memory access via via a USB device. (CVE-2021-21140)

  - Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass file extension policy via a crafted HTML page. (CVE-2021-21141)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for chromium fixes the following issues :

chromium was updated to 88.0.4324.96 boo#1181137

  - CVE-2021-21117: Insufficient policy enforcement in     Cryptohome

  - CVE-2021-21118: Insufficient data validation in V8

  - CVE-2021-21119: Use after free in Media

  - CVE-2021-21120: Use after free in WebSQL

  - CVE-2021-21121: Use after free in Omnibox

  - CVE-2021-21122: Use after free in Blink

  - CVE-2021-21123: Insufficient data validation in File     System API

  - CVE-2021-21124: Potential user after free in Speech     Recognizer

  - CVE-2021-21125: Insufficient policy enforcement in File     System API

  - CVE-2020-16044: Use after free in WebRTC

  - CVE-2021-21126: Insufficient policy enforcement in     extensions

  - CVE-2021-21127: Insufficient policy enforcement in     extensions

  - CVE-2021-21128: Heap buffer overflow in Blink

  - CVE-2021-21129: Insufficient policy enforcement in File     System API

  - CVE-2021-21130: Insufficient policy enforcement in File     System API

  - CVE-2021-21131: Insufficient policy enforcement in File     System API

  - CVE-2021-21132: Inappropriate implementation in DevTools

  - CVE-2021-21133: Insufficient policy enforcement in     Downloads

  - CVE-2021-21134: Incorrect security UI in Page Info

  - CVE-2021-21135: Inappropriate implementation in     Performance API

  - CVE-2021-21136: Insufficient policy enforcement in     WebView

  - CVE-2021-21137: Inappropriate implementation in DevTools

  - CVE-2021-21138: Use after free in DevTools

  - CVE-2021-21139: Inappropriate implementation in iframe     sandbox

  - CVE-2021-21140: Uninitialized Use in USB

  - CVE-2021-21141: Insufficient policy enforcement in File     System API

This update for chromium fixes the following issues :

Chromium was updated to 88.0.4324.96 boo#1181137

  - CVE-2021-21117: Insufficient policy enforcement in     Cryptohome

  - CVE-2021-21118: Insufficient data validation in V8

  - CVE-2021-21119: Use after free in Media

  - CVE-2021-21120: Use after free in WebSQL

  - CVE-2021-21121: Use after free in Omnibox

  - CVE-2021-21122: Use after free in Blink

  - CVE-2021-21123: Insufficient data validation in File     System API

  - CVE-2021-21124: Potential user after free in Speech     Recognizer

  - CVE-2021-21125: Insufficient policy enforcement in File     System API

  - CVE-2020-16044: Use after free in WebRTC

  - CVE-2021-21126: Insufficient policy enforcement in     extensions

  - CVE-2021-21127: Insufficient policy enforcement in     extensions

  - CVE-2021-21128: Heap buffer overflow in Blink

  - CVE-2021-21129: Insufficient policy enforcement in File     System API

  - CVE-2021-21130: Insufficient policy enforcement in File     System API

  - CVE-2021-21131: Insufficient policy enforcement in File     System API

  - CVE-2021-21132: Inappropriate implementation in DevTools

  - CVE-2021-21133: Insufficient policy enforcement in     Downloads

  - CVE-2021-21134: Incorrect security UI in Page Info

  - CVE-2021-21135: Inappropriate implementation in     Performance API

  - CVE-2021-21136: Insufficient policy enforcement in     WebView

  - CVE-2021-21137: Inappropriate implementation in DevTools

  - CVE-2021-21138: Use after free in DevTools

  - CVE-2021-21139: Inappropriate implementation in iframe     sandbox

  - CVE-2021-21140: Uninitialized Use in USB

  - CVE-2021-21141: Insufficient policy enforcement in File     System API

The version of Microsoft Edge installed on the remote Windows host is prior to 88.0.705.50. It is, therefore, affected by multiple vulnerabilities. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-48866282e5 advisory.

  - Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially     exploit heap corruption via a crafted SCTP packet. (CVE-2020-16044)

  - Insufficient policy enforcement in Cryptohome in Google Chrome prior to 88.0.4324.96 allowed a local     attacker to perform OS-level privilege escalation via a crafted file. (CVE-2021-21117)

  - Insufficient data validation in V8 in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to     potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-21118)

  - Use after free in Media in Google Chrome prior to 88.0.4324.96 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2021-21119)

  - Use after free in WebSQL in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21120)

  - Use after free in Omnibox in Google Chrome on Linux prior to 88.0.4324.96 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (CVE-2021-21121)

  - Use after free in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21122)

  - Insufficient data validation in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass filesystem restrictions via a crafted HTML page. (CVE-2021-21123)

  - Potential user after free in Speech Recognizer in Google Chrome on Android prior to 88.0.4324.96 allowed a     remote attacker to potentially perform a sandbox escape via a crafted HTML page. (CVE-2021-21124)

  - Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 88.0.4324.96     allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (CVE-2021-21125)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass site isolation via a crafted Chrome Extension. (CVE-2021-21126)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass content security policy via a crafted Chrome Extension. (CVE-2021-21127)

  - Heap buffer overflow in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21128)

  - Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass filesystem restrictions via a crafted HTML page. (CVE-2021-21129, CVE-2021-21130,     CVE-2021-21131)

  - Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker     to potentially perform a sandbox escape via a crafted Chrome Extension. (CVE-2021-21132)

  - Insufficient policy enforcement in Downloads in Google Chrome prior to 88.0.4324.96 allowed an attacker     who convinced a user to download files to bypass navigation restrictions via a crafted HTML page.
    (CVE-2021-21133)

  - Incorrect security UI in Page Info in Google Chrome on iOS prior to 88.0.4324.96 allowed a remote attacker     to spoof security UI via a crafted HTML page. (CVE-2021-21134)

  - Inappropriate implementation in Performance API in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21135)

  - Insufficient policy enforcement in WebView in Google Chrome on Android prior to 88.0.4324.96 allowed a     remote attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21136)

  - Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker     to obtain potentially sensitive information from disk via a crafted HTML page. (CVE-2021-21137)

  - Use after free in DevTools in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially     perform a sandbox escape via a crafted file. (CVE-2021-21138)

  - Inappropriate implementation in iframe sandbox in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass navigation restrictions via a crafted HTML page. (CVE-2021-21139)

  - Uninitialized use in USB in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially     perform out of bounds memory access via via a USB device. (CVE-2021-21140)

  - Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass file extension policy via a crafted HTML page. (CVE-2021-21141)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202101-13 (Chromium, Google Chrome: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and Google       Chrome. Please review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

Chrome Releases reports :

This release contains 36 security fixes, including :

- [1137179] Critical CVE-2021-21117: Insufficient policy enforcement in Cryptohome. Reported by Rory McNamara on 2020-10-10

- [1161357] High CVE-2021-21118: Insufficient data validation in V8.
Reported by Tyler Nighswander (@tylerni7) of Theori on 2020-12-23

- [1160534] High CVE-2021-21119: Use after free in Media. Reported by Anonymous on 2020-12-20

- [1160602] High CVE-2021-21120: Use after free in WebSQL. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2020-12-21

- [1161143] High CVE-2021-21121: Use after free in Omnibox. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2020-12-22

- [1162131] High CVE-2021-21122: Use after free in Blink. Reported by Renata Hodovan on 2020-12-28

- [1137247] High CVE-2021-21123: Insufficient data validation in File System API. Reported by Maciej Pulikowski on 2020-10-11

- [1131346] High CVE-2021-21124: Potential user after free in Speech Recognizer. Reported by Chaoyang Ding(@V4kst1z) from Codesafe Team of Legendsec at Qi'anxin Group on 2020-09-23

- [1152327] High CVE-2021-21125: Insufficient policy enforcement in File System API. Reported by Ron Masas (Imperva) on 2020-11-24

- [1163228] High CVE-2020-16044: Use after free in WebRTC. Reported by Ned Williamson of Project Zero on 2021-01-05

- [1108126] Medium CVE-2021-21126: Insufficient policy enforcement in extensions. Reported by David Erceg on 2020-07-22

- [1115590] Medium CVE-2021-21127: Insufficient policy enforcement in extensions. Reported by Jasminder Pal Singh, Web Services Point WSP, Kotkapura on 2020-08-12

- [1138877] Medium CVE-2021-21128: Heap buffer overflow in Blink.
Reported by Liang Dong on 2020-10-15

- [1140403] Medium CVE-2021-21129: Insufficient policy enforcement in File System API. Reported by Maciej Pulikowski on 2020-10-20

- [1140410] Medium CVE-2021-21130: Insufficient policy enforcement in File System API. Reported by Maciej Pulikowski on 2020-10-20

- [1140417] Medium CVE-2021-21131: Insufficient policy enforcement in File System API. Reported by Maciej Pulikowski on 2020-10-20

- [1128206] Medium CVE-2021-21132: Inappropriate implementation in DevTools. Reported by David Erceg on 2020-09-15

- [1157743] Medium CVE-2021-21133: Insufficient policy enforcement in Downloads. Reported by wester0x01 (https://twitter.com/wester0x01) on 2020-12-11

- [1157800] Medium CVE-2021-21134: Incorrect security UI in Page Info.
Reported by wester0x01 (https://twitter.com/wester0x01) on 2020-12-11

- [1157818] Medium CVE-2021-21135: Inappropriate implementation in Performance API. Reported by ndevtk on 2020-12-11

- [1038002] Low CVE-2021-21136: Insufficient policy enforcement in WebView. Reported by Shiv Sahni, Movnavinothan V and Imdad Mohammed on 2019-12-27

- [1093791] Low CVE-2021-21137: Inappropriate implementation in DevTools. Reported by bobblybear on 2020-06-11

- [1122487] Low CVE-2021-21138: Use after free in DevTools. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi'anxin Group on 2020-08-27

- [1136327] Low CVE-2021-21140: Uninitialized Use in USB. Reported by David Manouchehri on 2020-10-08

- [1140435] Low CVE-2021-21141: Insufficient policy enforcement in File System API. Reported by Maciej Pulikowski on 2020-10-20

The version of Google Chrome installed on the remote macOS host is prior to 88.0.4324.96. It is, therefore, affected by multiple vulnerabilities as referenced in the 2021_01_stable-channel-update-for-desktop_19 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 88.0.4324.96. It is, therefore, affected by multiple vulnerabilities as referenced in the 2021_01_stable-channel-update-for-desktop_19 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
146318	Debian DSA-4846-1 : chromium - security update	Nessus	Debian Local Security Checks	critical
145776	Fedora 32 : chromium (2021-b7cc24375b)	Nessus	Fedora Local Security Checks	critical
145729	openSUSE Security Update : chromium (openSUSE-2021-173)	Nessus	SuSE Local Security Checks	critical
145485	openSUSE Security Update : chromium (openSUSE-2021-166)	Nessus	SuSE Local Security Checks	critical
145448	Microsoft Edge (Chromium) < 88.0.705.50 Multiple Vulnerabilities	Nessus	Windows	critical
145391	Fedora 33 : chromium (2021-48866282e5)	Nessus	Fedora Local Security Checks	critical
145341	GLSA-202101-13 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
145316	FreeBSD : chromium -- multiple vulnerabilities (4ed0e43c-5cef-11eb-bafd-3065ec8fd3ec)	Nessus	FreeBSD Local Security Checks	critical
145072	Google Chrome < 88.0.4324.96 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
145071	Google Chrome < 88.0.4324.96 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2021-21124

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical