Login Sign Up

CVE-2021-21174

8.8 HIGH

📋 TL;DR

This vulnerability in Google Chrome's Referrer implementation allowed attackers to bypass navigation restrictions via crafted HTML pages. It affects users running Chrome versions before 89.0.4389.72, potentially enabling unauthorized navigation to restricted sites.

💻 Affected Systems

Products:
  • Google Chrome
Versions: All versions prior to 89.0.4389.72
Operating Systems: Windows, Linux, macOS, Android, iOS
Default Config Vulnerable: ⚠️ Yes
Notes: All default Chrome installations before version 89.0.4389.72 are vulnerable.

📦 What is this software?

Chrome by Google

Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...

Learn more about Chrome →

Debian Linux by Debian

View all CVEs affecting Debian Linux →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Attackers could redirect users to malicious sites, bypass security controls, and potentially facilitate phishing attacks or cross-site request forgery.

🟠

Likely Case

Most probable impact is unauthorized navigation to restricted pages, potentially exposing sensitive information or enabling social engineering attacks.

🟢

If Mitigated

With proper controls like updated browsers and security policies, impact is minimal as the vulnerability is patched in current versions.

🌐 Internet-Facing: HIGH
🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ⚠️ Yes
Complexity: LOW

Exploitation requires user interaction (visiting a crafted HTML page).

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 89.0.4389.72

Vendor Advisory: https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop.html

Restart Required: Yes

Instructions:

1. Open Chrome. 2. Click the three-dot menu. 3. Go to Help > About Google Chrome. 4. Chrome will automatically check for and install updates. 5. Restart Chrome when prompted.

🔧 Temporary Workarounds

Disable JavaScript

all

Temporarily disable JavaScript to prevent exploitation via crafted HTML pages.

chrome://settings/content/javascript

🧯 If You Can't Patch

  • Use alternative browsers until Chrome can be updated.
  • Implement network filtering to block suspicious HTML pages and restrict navigation.

🔍 How to Verify

Check if Vulnerable:

Check Chrome version via chrome://settings/help or 'chrome://version'.

Check Version:

google-chrome --version

Verify Fix Applied:

Verify Chrome version is 89.0.4389.72 or later.

📡 Detection & Monitoring

Log Indicators:

  • Unusual navigation patterns in Chrome logs
  • Referrer policy violations

Network Indicators:

  • Suspicious HTML page requests with crafted referrers

SIEM Query:

source="chrome" AND (event="navigation" OR event="referrer") AND status="blocked"

📊 Metadata

CVE ID: CVE-2021-21174
CVSS v3 Score: 8.8 (HIGH)
CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Published: March 9, 2021
Last Updated: November 21, 2024

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON