Use after free in DevTools in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially perform a sandbox escape via a crafted file.

Several vulnerabilities have been discovered in the chromium web browser.

  - CVE-2020-16044     Ned Williamson discovered a use-after-free issue in the     WebRTC implementation.

  - CVE-2021-21117     Rory McNamara discovered a policy enforcement issue in     Cryptohome.

  - CVE-2021-21118     Tyler Nighswander discovered a data validation issue in     the v8 JavaScript library.

  - CVE-2021-21119     A use-after-free issue was discovered in media handling.

  - CVE-2021-21120     Nan Wang and Guang Gong discovered a use-after-free     issue in the WebSQL implementation.

  - CVE-2021-21121     Leecraso and Guang Gong discovered a use-after-free     issue in the Omnibox.

  - CVE-2021-21122     Renata Hodovan discovered a use-after-free issue in     Blink/WebKit.

  - CVE-2021-21123     Maciej Pulikowski discovered a data validation issue.

  - CVE-2021-21124     Chaoyang Ding discovered a use-after-free issue in the     speech recognizer.

  - CVE-2021-21125     Ron Masas discovered a policy enforcement issue.

  - CVE-2021-21126     David Erceg discovered a policy enforcement issue in     extensions.

  - CVE-2021-21127     Jasminder Pal Singh discovered a policy enforcement     issue in extensions.

  - CVE-2021-21128     Liang Dong discovered a buffer overflow issue in     Blink/WebKit.

  - CVE-2021-21129     Maciej Pulikowski discovered a policy enforcement issue.

  - CVE-2021-21130     Maciej Pulikowski discovered a policy enforcement issue.

  - CVE-2021-21131     Maciej Pulikowski discovered a policy enforcement issue.

  - CVE-2021-21132     David Erceg discovered an implementation error in the     developer tools.

  - CVE-2021-21133     wester0x01 discovered a policy enforcement issue.

  - CVE-2021-21134     wester0x01 discovered a user interface error.

  - CVE-2021-21135     ndevtk discovered an implementation error in the     Performance API.

  - CVE-2021-21136     Shiv Sahni, Movnavinothan V, and Imdad Mohammed     discovered a policy enforcement error.

  - CVE-2021-21137     bobbybear discovered an implementation error in the     developer tools.

  - CVE-2021-21138     Weipeng Jiang discovered a use-after-free issue in the     developer tools.

  - CVE-2021-21139     Jun Kokatsu discovered an implementation error in the     iframe sandbox.

  - CVE-2021-21140     David Manouchehri discovered uninitialized memory in the     USB implementation.

  - CVE-2021-21141     Maciej Pulikowski discovered a policy enforcement error.

  - CVE-2021-21142     Khalil Zhani discovered a use-after-free issue.

  - CVE-2021-21143     Allen Parker and Alex Morgan discovered a buffer     overflow issue in extensions.

  - CVE-2021-21144     Leecraso and Guang Gong discovered a buffer overflow     issue.

  - CVE-2021-21145     A use-after-free issue was discovered.

  - CVE-2021-21146     Alison Huffman and Choongwoo Han discovered a     use-after-free issue.

  - CVE-2021-21147     Roman Starkov discovered an implementation error in the     skia library.

The remote Fedora 32 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-b7cc24375b advisory.

  - Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially     exploit heap corruption via a crafted SCTP packet. (CVE-2020-16044)

  - Insufficient policy enforcement in Cryptohome in Google Chrome prior to 88.0.4324.96 allowed a local     attacker to perform OS-level privilege escalation via a crafted file. (CVE-2021-21117)

  - Insufficient data validation in V8 in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to     potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-21118)

  - Use after free in Media in Google Chrome prior to 88.0.4324.96 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2021-21119)

  - Use after free in WebSQL in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21120)

  - Use after free in Omnibox in Google Chrome on Linux prior to 88.0.4324.96 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (CVE-2021-21121)

  - Use after free in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21122)

  - Insufficient data validation in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass filesystem restrictions via a crafted HTML page. (CVE-2021-21123)

  - Potential user after free in Speech Recognizer in Google Chrome on Android prior to 88.0.4324.96 allowed a     remote attacker to potentially perform a sandbox escape via a crafted HTML page. (CVE-2021-21124)

  - Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 88.0.4324.96     allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (CVE-2021-21125)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass site isolation via a crafted Chrome Extension. (CVE-2021-21126)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass content security policy via a crafted Chrome Extension. (CVE-2021-21127)

  - Heap buffer overflow in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21128)

  - Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass filesystem restrictions via a crafted HTML page. (CVE-2021-21129, CVE-2021-21130,     CVE-2021-21131)

  - Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker     to potentially perform a sandbox escape via a crafted Chrome Extension. (CVE-2021-21132)

  - Insufficient policy enforcement in Downloads in Google Chrome prior to 88.0.4324.96 allowed an attacker     who convinced a user to download files to bypass navigation restrictions via a crafted HTML page.
    (CVE-2021-21133)

  - Incorrect security UI in Page Info in Google Chrome on iOS prior to 88.0.4324.96 allowed a remote attacker     to spoof security UI via a crafted HTML page. (CVE-2021-21134)

  - Inappropriate implementation in Performance API in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21135)

  - Insufficient policy enforcement in WebView in Google Chrome on Android prior to 88.0.4324.96 allowed a     remote attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21136)

  - Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker     to obtain potentially sensitive information from disk via a crafted HTML page. (CVE-2021-21137)

  - Use after free in DevTools in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially     perform a sandbox escape via a crafted file. (CVE-2021-21138)

  - Inappropriate implementation in iframe sandbox in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass navigation restrictions via a crafted HTML page. (CVE-2021-21139)

  - Uninitialized use in USB in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially     perform out of bounds memory access via via a USB device. (CVE-2021-21140)

  - Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass file extension policy via a crafted HTML page. (CVE-2021-21141)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for chromium fixes the following issues :

chromium was updated to 88.0.4324.96 boo#1181137

  - CVE-2021-21117: Insufficient policy enforcement in     Cryptohome

  - CVE-2021-21118: Insufficient data validation in V8

  - CVE-2021-21119: Use after free in Media

  - CVE-2021-21120: Use after free in WebSQL

  - CVE-2021-21121: Use after free in Omnibox

  - CVE-2021-21122: Use after free in Blink

  - CVE-2021-21123: Insufficient data validation in File     System API

  - CVE-2021-21124: Potential user after free in Speech     Recognizer

  - CVE-2021-21125: Insufficient policy enforcement in File     System API

  - CVE-2020-16044: Use after free in WebRTC

  - CVE-2021-21126: Insufficient policy enforcement in     extensions

  - CVE-2021-21127: Insufficient policy enforcement in     extensions

  - CVE-2021-21128: Heap buffer overflow in Blink

  - CVE-2021-21129: Insufficient policy enforcement in File     System API

  - CVE-2021-21130: Insufficient policy enforcement in File     System API

  - CVE-2021-21131: Insufficient policy enforcement in File     System API

  - CVE-2021-21132: Inappropriate implementation in DevTools

  - CVE-2021-21133: Insufficient policy enforcement in     Downloads

  - CVE-2021-21134: Incorrect security UI in Page Info

  - CVE-2021-21135: Inappropriate implementation in     Performance API

  - CVE-2021-21136: Insufficient policy enforcement in     WebView

  - CVE-2021-21137: Inappropriate implementation in DevTools

  - CVE-2021-21138: Use after free in DevTools

  - CVE-2021-21139: Inappropriate implementation in iframe     sandbox

  - CVE-2021-21140: Uninitialized Use in USB

  - CVE-2021-21141: Insufficient policy enforcement in File     System API

This update for chromium fixes the following issues :

Chromium was updated to 88.0.4324.96 boo#1181137

  - CVE-2021-21117: Insufficient policy enforcement in     Cryptohome

  - CVE-2021-21118: Insufficient data validation in V8

  - CVE-2021-21119: Use after free in Media

  - CVE-2021-21120: Use after free in WebSQL

  - CVE-2021-21121: Use after free in Omnibox

  - CVE-2021-21122: Use after free in Blink

  - CVE-2021-21123: Insufficient data validation in File     System API

  - CVE-2021-21124: Potential user after free in Speech     Recognizer

  - CVE-2021-21125: Insufficient policy enforcement in File     System API

  - CVE-2020-16044: Use after free in WebRTC

  - CVE-2021-21126: Insufficient policy enforcement in     extensions

  - CVE-2021-21127: Insufficient policy enforcement in     extensions

  - CVE-2021-21128: Heap buffer overflow in Blink

  - CVE-2021-21129: Insufficient policy enforcement in File     System API

  - CVE-2021-21130: Insufficient policy enforcement in File     System API

  - CVE-2021-21131: Insufficient policy enforcement in File     System API

  - CVE-2021-21132: Inappropriate implementation in DevTools

  - CVE-2021-21133: Insufficient policy enforcement in     Downloads

  - CVE-2021-21134: Incorrect security UI in Page Info

  - CVE-2021-21135: Inappropriate implementation in     Performance API

  - CVE-2021-21136: Insufficient policy enforcement in     WebView

  - CVE-2021-21137: Inappropriate implementation in DevTools

  - CVE-2021-21138: Use after free in DevTools

  - CVE-2021-21139: Inappropriate implementation in iframe     sandbox

  - CVE-2021-21140: Uninitialized Use in USB

  - CVE-2021-21141: Insufficient policy enforcement in File     System API

The remote Fedora 33 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2021-48866282e5 advisory.

  - Use after free in WebRTC in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially     exploit heap corruption via a crafted SCTP packet. (CVE-2020-16044)

  - Insufficient policy enforcement in Cryptohome in Google Chrome prior to 88.0.4324.96 allowed a local     attacker to perform OS-level privilege escalation via a crafted file. (CVE-2021-21117)

  - Insufficient data validation in V8 in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to     potentially perform out of bounds memory access via a crafted HTML page. (CVE-2021-21118)

  - Use after free in Media in Google Chrome prior to 88.0.4324.96 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2021-21119)

  - Use after free in WebSQL in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21120)

  - Use after free in Omnibox in Google Chrome on Linux prior to 88.0.4324.96 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (CVE-2021-21121)

  - Use after free in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2021-21122)

  - Insufficient data validation in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass filesystem restrictions via a crafted HTML page. (CVE-2021-21123)

  - Potential user after free in Speech Recognizer in Google Chrome on Android prior to 88.0.4324.96 allowed a     remote attacker to potentially perform a sandbox escape via a crafted HTML page. (CVE-2021-21124)

  - Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 88.0.4324.96     allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page. (CVE-2021-21125)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass site isolation via a crafted Chrome Extension. (CVE-2021-21126)

  - Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass content security policy via a crafted Chrome Extension. (CVE-2021-21127)

  - Heap buffer overflow in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2021-21128)

  - Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass filesystem restrictions via a crafted HTML page. (CVE-2021-21129, CVE-2021-21130,     CVE-2021-21131)

  - Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker     to potentially perform a sandbox escape via a crafted Chrome Extension. (CVE-2021-21132)

  - Insufficient policy enforcement in Downloads in Google Chrome prior to 88.0.4324.96 allowed an attacker     who convinced a user to download files to bypass navigation restrictions via a crafted HTML page.
    (CVE-2021-21133)

  - Incorrect security UI in Page Info in Google Chrome on iOS prior to 88.0.4324.96 allowed a remote attacker     to spoof security UI via a crafted HTML page. (CVE-2021-21134)

  - Inappropriate implementation in Performance API in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21135)

  - Insufficient policy enforcement in WebView in Google Chrome on Android prior to 88.0.4324.96 allowed a     remote attacker to leak cross-origin data via a crafted HTML page. (CVE-2021-21136)

  - Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker     to obtain potentially sensitive information from disk via a crafted HTML page. (CVE-2021-21137)

  - Use after free in DevTools in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially     perform a sandbox escape via a crafted file. (CVE-2021-21138)

  - Inappropriate implementation in iframe sandbox in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass navigation restrictions via a crafted HTML page. (CVE-2021-21139)

  - Uninitialized use in USB in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially     perform out of bounds memory access via via a USB device. (CVE-2021-21140)

  - Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote     attacker to bypass file extension policy via a crafted HTML page. (CVE-2021-21141)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-202101-13 (Chromium, Google Chrome: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and Google       Chrome. Please review the CVE identifiers referenced below for details.
  Impact :

    Please review the referenced CVE identifiers for details.
  Workaround :

    There is no known workaround at this time.

Chrome Releases reports :

This release contains 36 security fixes, including :

- [1137179] Critical CVE-2021-21117: Insufficient policy enforcement in Cryptohome. Reported by Rory McNamara on 2020-10-10

- [1161357] High CVE-2021-21118: Insufficient data validation in V8.
Reported by Tyler Nighswander (@tylerni7) of Theori on 2020-12-23

- [1160534] High CVE-2021-21119: Use after free in Media. Reported by Anonymous on 2020-12-20

- [1160602] High CVE-2021-21120: Use after free in WebSQL. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Alpha Lab on 2020-12-21

- [1161143] High CVE-2021-21121: Use after free in Omnibox. Reported by Leecraso and Guang Gong of 360 Alpha Lab on 2020-12-22

- [1162131] High CVE-2021-21122: Use after free in Blink. Reported by Renata Hodovan on 2020-12-28

- [1137247] High CVE-2021-21123: Insufficient data validation in File System API. Reported by Maciej Pulikowski on 2020-10-11

- [1131346] High CVE-2021-21124: Potential user after free in Speech Recognizer. Reported by Chaoyang Ding(@V4kst1z) from Codesafe Team of Legendsec at Qi'anxin Group on 2020-09-23

- [1152327] High CVE-2021-21125: Insufficient policy enforcement in File System API. Reported by Ron Masas (Imperva) on 2020-11-24

- [1163228] High CVE-2020-16044: Use after free in WebRTC. Reported by Ned Williamson of Project Zero on 2021-01-05

- [1108126] Medium CVE-2021-21126: Insufficient policy enforcement in extensions. Reported by David Erceg on 2020-07-22

- [1115590] Medium CVE-2021-21127: Insufficient policy enforcement in extensions. Reported by Jasminder Pal Singh, Web Services Point WSP, Kotkapura on 2020-08-12

- [1138877] Medium CVE-2021-21128: Heap buffer overflow in Blink.
Reported by Liang Dong on 2020-10-15

- [1140403] Medium CVE-2021-21129: Insufficient policy enforcement in File System API. Reported by Maciej Pulikowski on 2020-10-20

- [1140410] Medium CVE-2021-21130: Insufficient policy enforcement in File System API. Reported by Maciej Pulikowski on 2020-10-20

- [1140417] Medium CVE-2021-21131: Insufficient policy enforcement in File System API. Reported by Maciej Pulikowski on 2020-10-20

- [1128206] Medium CVE-2021-21132: Inappropriate implementation in DevTools. Reported by David Erceg on 2020-09-15

- [1157743] Medium CVE-2021-21133: Insufficient policy enforcement in Downloads. Reported by wester0x01 (https://twitter.com/wester0x01) on 2020-12-11

- [1157800] Medium CVE-2021-21134: Incorrect security UI in Page Info.
Reported by wester0x01 (https://twitter.com/wester0x01) on 2020-12-11

- [1157818] Medium CVE-2021-21135: Inappropriate implementation in Performance API. Reported by ndevtk on 2020-12-11

- [1038002] Low CVE-2021-21136: Insufficient policy enforcement in WebView. Reported by Shiv Sahni, Movnavinothan V and Imdad Mohammed on 2019-12-27

- [1093791] Low CVE-2021-21137: Inappropriate implementation in DevTools. Reported by bobblybear on 2020-06-11

- [1122487] Low CVE-2021-21138: Use after free in DevTools. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi'anxin Group on 2020-08-27

- [1136327] Low CVE-2021-21140: Uninitialized Use in USB. Reported by David Manouchehri on 2020-10-08

- [1140435] Low CVE-2021-21141: Insufficient policy enforcement in File System API. Reported by Maciej Pulikowski on 2020-10-20

The version of Google Chrome installed on the remote macOS host is prior to 88.0.4324.96. It is, therefore, affected by multiple vulnerabilities as referenced in the 2021_01_stable-channel-update-for-desktop_19 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 88.0.4324.96. It is, therefore, affected by multiple vulnerabilities as referenced in the 2021_01_stable-channel-update-for-desktop_19 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
146318	Debian DSA-4846-1 : chromium - security update	Nessus	Debian Local Security Checks	critical
145776	Fedora 32 : chromium (2021-b7cc24375b)	Nessus	Fedora Local Security Checks	critical
145729	openSUSE Security Update : chromium (openSUSE-2021-173)	Nessus	SuSE Local Security Checks	critical
145485	openSUSE Security Update : chromium (openSUSE-2021-166)	Nessus	SuSE Local Security Checks	critical
145391	Fedora 33 : chromium (2021-48866282e5)	Nessus	Fedora Local Security Checks	critical
145341	GLSA-202101-13 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
145316	FreeBSD : chromium -- multiple vulnerabilities (4ed0e43c-5cef-11eb-bafd-3065ec8fd3ec)	Nessus	FreeBSD Local Security Checks	critical
145072	Google Chrome < 88.0.4324.96 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
145071	Google Chrome < 88.0.4324.96 Multiple Vulnerabilities	Nessus	Windows	critical

Detections

Analytics

CVE-2021-21138

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical