CVE-2021-36773 – This vulnerability allows malicious websites to... (How to Fix)

Q: How do I fix CVE-2021-36773?

1. Open browser extensions page 2. Check for updates for uBlock Origin/uMatrix 3. Update to latest version 4. Reload browser tabs if needed

Q: What is the severity of CVE-2021-36773?

CVE-2021-36773 has a CVSS score of 7.5 (HIGH). This vulnerability allows malicious websites to cause denial of service in uBlock Origin and uMatrix browser extensions through crafted filter rules that trigger unbounded recursion. This can consume excessive memory and disable all blocking functionality. Users of affected versions are vulnerable when visiting malicious sites.

📋 TL;DR

This vulnerability allows malicious websites to cause denial of service in uBlock Origin and uMatrix browser extensions through crafted filter rules that trigger unbounded recursion. This can consume excessive memory and disable all blocking functionality. Users of affected versions are vulnerable when visiting malicious sites.

💻 Affected Systems

Products:

uBlock Origin
uMatrix

Versions: uBlock Origin < 1.36.2, uMatrix < 4.4.9

Operating Systems: All platforms where these extensions run (Windows, macOS, Linux, ChromeOS)

Default Config Vulnerable: ⚠️ Yes

Notes: All installations with affected versions are vulnerable regardless of configuration

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete browser tab crash or browser instability due to memory exhaustion, with all content filtering disabled allowing malicious content through

🟠

Likely Case

Browser tab becomes unresponsive, requiring tab closure, with temporary loss of ad/tracker blocking until browser restart

🟢

If Mitigated

No impact if using patched versions or if malicious site is blocked by other security measures

🌐 Internet-Facing: HIGH - Exploitation requires only visiting a malicious website

🏢 Internal Only: LOW - Requires user interaction with malicious content

🎯 Exploit Status

Public PoC: ⚠️ Yes

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires only visiting a malicious website with crafted filter rules

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: uBlock Origin 1.36.2+, uMatrix 4.4.9+

Vendor Advisory: https://github.com/gorhill/uBlock/releases/tag/1.36.2

Restart Required: No

Instructions:

1. Open browser extensions page 2. Check for updates for uBlock Origin/uMatrix 3. Update to latest version 4. Reload browser tabs if needed

🔧 Temporary Workarounds

Disable strict blocking

all

Temporarily disable strict blocking mode in extension settings

Use alternative ad blocker

all

Temporarily switch to different ad blocking extension

🧯 If You Can't Patch

Disable the affected extensions until patched
Use browser's built-in tracking protection as temporary alternative

🔍 How to Verify

Check if Vulnerable:

Check extension version in browser extensions page: uBlock Origin < 1.36.2 or uMatrix < 4.4.9

Check Version:

Browser-specific: chrome://extensions/ or about:addons

Verify Fix Applied:

Confirm extension version is uBlock Origin ≥ 1.36.2 or uMatrix ≥ 4.4.9

📡 Detection & Monitoring

Log Indicators:

Browser crash logs showing memory exhaustion
Extension error logs with recursion depth warnings

Network Indicators:

Unusual filter rule requests with deep nesting patterns

SIEM Query:

Browser extension logs containing 'ublock' or 'umatrix' with error codes related to memory or recursion

📊 Metadata

CVE ID: CVE-2021-36773

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-674

Published: July 18, 2021

Last Updated: November 21, 2024

🔗 References

https://github.com/vtriolet/writings/blob/main/posts/2021/ublock_origin_and_umatrix_denial_of_service.adoc Exploit,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/06/msg00024.html Mailing List,Third Party Advisory
https://news.ycombinator.com/item?id=27833752 Issue Tracking,Third Party Advisory
https://github.com/vtriolet/writings/blob/main/posts/2021/ublock_origin_and_umatrix_denial_of_service.adoc Exploit,Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/06/msg00024.html Mailing List,Third Party Advisory
https://news.ycombinator.com/item?id=27833752 Issue Tracking,Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-36773, you might also want to check these: