CVE-2021-21201
📋 TL;DR
This is a use-after-free vulnerability in Google Chrome's permissions system that allows an attacker who has already compromised the renderer process to potentially escape the browser sandbox. Attackers could execute arbitrary code with higher privileges by tricking users into visiting a malicious webpage. All Chrome users prior to version 90.0.4430.72 are affected.
💻 Affected Systems
- Google Chrome
- Chromium-based browsers
📦 What is this software?
Chrome by Google
Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...
Learn more about Chrome →Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise via sandbox escape leading to arbitrary code execution with user privileges, potentially enabling persistence, data theft, and lateral movement.
Likely Case
Limited sandbox escape allowing attackers to perform actions with elevated privileges within the browser context, potentially accessing local files or system resources.
If Mitigated
Contained within browser sandbox with no privilege escalation if renderer process compromise hasn't occurred.
🎯 Exploit Status
Requires chaining with another vulnerability to first compromise renderer process, then exploiting this for sandbox escape.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 90.0.4430.72 and later
Vendor Advisory: https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html
Restart Required: Yes
Instructions:
1. Open Chrome and click the three-dot menu. 2. Go to Help > About Google Chrome. 3. Chrome will automatically check for updates and install version 90.0.4430.72 or later. 4. Click 'Relaunch' to restart Chrome.
🔧 Temporary Workarounds
Disable JavaScript
allPrevents exploitation by disabling JavaScript execution, but breaks most web functionality.
Use Site Isolation
allEnable site isolation to contain renderer process compromises.
Navigate to chrome://flags/#enable-site-per-process and enable it
🧯 If You Can't Patch
- Restrict browser usage to trusted websites only
- Implement application whitelisting to prevent unauthorized Chrome execution
🔍 How to Verify
Check if Vulnerable:
Check Chrome version by navigating to chrome://settings/help or clicking Help > About Google Chrome.Check Version:
google-chrome --version (Linux) or "C:\Program Files\Google\Chrome\Application\chrome.exe" --version (Windows)Verify Fix Applied:
Verify Chrome version is 90.0.4430.72 or higher in About Google Chrome page.📡 Detection & Monitoring
Log Indicators:
- Chrome crash reports with suspicious memory access patterns
- Unexpected Chrome child process creation with elevated privileges
Network Indicators:
- Connections to known malicious domains followed by unusual local system activity
SIEM Query:
process_name:"chrome.exe" AND (parent_process_name:"chrome.exe" AND command_line:"--type=*" AND NOT command_line:"--type=renderer")🔗 References
- https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html
- https://crbug.com/1025683
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/
- https://security.gentoo.org/glsa/202104-08
- https://www.debian.org/security/2021/dsa-4906
- https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html
- https://crbug.com/1025683
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/
- https://security.gentoo.org/glsa/202104-08
- https://www.debian.org/security/2021/dsa-4906
