Login Sign Up

CVE-2021-21172

8.1 HIGH

📋 TL;DR

This vulnerability in Google Chrome's File System API on Windows allows attackers to bypass filesystem restrictions via a malicious HTML page. It affects Chrome users on Windows who visit compromised websites. The flaw enables unauthorized file system access that should be blocked by security policies.

💻 Affected Systems

Products:
  • Google Chrome
Versions: All versions prior to 89.0.4389.72
Operating Systems: Windows
Default Config Vulnerable: ⚠️ Yes
Notes: Only affects Chrome on Windows operating systems. Other browsers and Chrome on other OSes are not affected.

📦 What is this software?

Chrome by Google

Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...

Learn more about Chrome →

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could read, modify, or delete sensitive files on the user's system, potentially leading to data theft, ransomware deployment, or system compromise.

🟠

Likely Case

Attackers could access user files in directories that should be protected, potentially stealing documents, credentials, or other sensitive data.

🟢

If Mitigated

With proper browser updates and security controls, the risk is eliminated as the vulnerability is patched in newer versions.

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Exploitation requires user interaction (visiting a malicious website) but no authentication. The vulnerability is in the browser's security policy enforcement.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 89.0.4389.72

Vendor Advisory: https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop.html

Restart Required: Yes

Instructions:

1. Open Chrome browser 2. Click the three-dot menu 3. Go to Help > About Google Chrome 4. Chrome will automatically check for and install updates 5. Restart Chrome when prompted

🔧 Temporary Workarounds

Disable File System API

all

Temporarily disable the File System API via Chrome flags to prevent exploitation

chrome://flags/#enable-experimental-web-platform-features
Set to 'Disabled'

Use alternative browser

all

Switch to an unaffected browser until Chrome can be updated

🧯 If You Can't Patch

  • Implement web filtering to block malicious sites
  • Use application whitelisting to restrict unauthorized file system access

🔍 How to Verify

Check if Vulnerable:

Check Chrome version: if below 89.0.4389.72 on Windows, you are vulnerable

Check Version:

chrome://version/

Verify Fix Applied:

Verify Chrome version is 89.0.4389.72 or higher

📡 Detection & Monitoring

Log Indicators:

  • Unusual file system access patterns from Chrome processes
  • Multiple failed file access attempts from web origins

Network Indicators:

  • Connections to suspicious domains followed by file system activity
  • Unusual outbound traffic patterns after visiting websites

SIEM Query:

source="chrome" AND (event="file_access" OR event="filesystem_api") AND result="success" AND user_agent CONTAINS "Chrome/" AND version<"89.0.4389.72"

📊 Metadata

CVE ID: CVE-2021-21172
CVSS v3 Score: 8.1 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Published: March 9, 2021
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON