CVE-2021-21117
📋 TL;DR
This vulnerability in Google Chrome's Cryptohome component allows a local attacker to escalate operating system privileges through a specially crafted file. It affects Chrome users on desktop platforms who haven't updated to the patched version. The attacker needs local access to the system to exploit this flaw.
💻 Affected Systems
- Google Chrome
📦 What is this software?
Chrome by Google
Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...
Learn more about Chrome →⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise where an attacker gains root/admin privileges, potentially installing persistent malware, accessing all user data, and controlling the entire system.
Likely Case
Local privilege escalation allowing an attacker to bypass user account restrictions, access other users' data, or install unauthorized software.
If Mitigated
Limited impact with proper user account separation and minimal local attack surface, though privilege escalation could still occur within the user's context.
🎯 Exploit Status
Requires local access and ability to create/place a crafted file; no public exploit code has been released according to available references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 88.0.4324.96 and later
Vendor Advisory: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html
Restart Required: Yes
Instructions:
1. Open Chrome browser 2. Click the three-dot menu → Help → About Google Chrome 3. Chrome will automatically check for updates and install version 88.0.4324.96 or later 4. Click 'Relaunch' to restart Chrome with the update
🔧 Temporary Workarounds
Disable Chrome auto-updates (temporary)
allPrevents Chrome from updating automatically, but this is NOT recommended as it leaves systems vulnerable. Only use if absolutely necessary for compatibility testing.
Windows: Disable Google Update service
Linux: Remove Chrome from package manager auto-update
macOS: Disable automatic updates in Chrome settings
🧯 If You Can't Patch
- Implement strict user account separation and least privilege principles to limit damage from privilege escalation
- Use application whitelisting to prevent execution of unauthorized binaries that might exploit this vulnerability
🔍 How to Verify
Check if Vulnerable:
Check Chrome version: If version is less than 88.0.4324.96, the system is vulnerableCheck Version:
chrome://version/ in Chrome address bar or 'google-chrome --version' in terminalVerify Fix Applied:
Confirm Chrome version is 88.0.4324.96 or higher after update📡 Detection & Monitoring
Log Indicators:
- Unusual Chrome process behavior
- Failed privilege escalation attempts in system logs
- Unexpected file operations in Chrome data directories
Network Indicators:
- Not applicable - local vulnerability
SIEM Query:
Process creation where parent_process contains 'chrome' and command_line contains suspicious file operations or privilege escalation attempts