CVE-2021-4052
📋 TL;DR
This is a use-after-free vulnerability in Google Chrome's web app component that allows heap corruption. Attackers can exploit it by tricking users into installing malicious Chrome extensions, potentially leading to arbitrary code execution. All Chrome users prior to version 96.0.4664.93 are affected.
💻 Affected Systems
- Google Chrome
📦 What is this software?
Chrome by Google
Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...
Learn more about Chrome →Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution with the privileges of the Chrome process, potentially leading to full system compromise.
Likely Case
Browser crash or limited data exfiltration through malicious extension capabilities.
If Mitigated
No impact if Chrome is updated or malicious extensions are prevented from installation.
🎯 Exploit Status
Exploitation requires convincing a user to install a malicious Chrome extension, which adds a social engineering component. The use-after-free to heap corruption chain requires technical sophistication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 96.0.4664.93
Vendor Advisory: https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html
Restart Required: Yes
Instructions:
1. Open Chrome. 2. Click the three-dot menu → Help → About Google Chrome. 3. Chrome will automatically check for updates and install version 96.0.4664.93 or later. 4. Click 'Relaunch' to restart Chrome.
🔧 Temporary Workarounds
Disable Chrome Extension Installation
allPrevent users from installing Chrome extensions through enterprise policies or browser settings.
For enterprise: Configure Chrome policy 'ExtensionInstallBlocklist' to '*' or 'ExtensionInstallAllowlist' to approved extensions only.
Restrict Extension Sources
allOnly allow extensions from the Chrome Web Store via enterprise policy.
Configure Chrome policy 'ExtensionInstallSources' to only allow 'https://chrome.google.com/webstore/*'.
🧯 If You Can't Patch
- Disable or uninstall all non-essential Chrome extensions to reduce attack surface.
- Use alternative browsers until Chrome can be updated.
🔍 How to Verify
Check if Vulnerable:
Check Chrome version: if below 96.0.4664.93, the system is vulnerable.Check Version:
On command line: google-chrome --version (Linux) or 'chrome://version' in Chrome address bar.Verify Fix Applied:
Confirm Chrome version is 96.0.4664.93 or higher after update.📡 Detection & Monitoring
Log Indicators:
- Chrome crash logs with memory corruption errors
- Unexpected installation of Chrome extensions from non-store sources
Network Indicators:
- Downloads of .crx files from untrusted sources
- Connections to known malicious extension hosting domains
SIEM Query:
Example: 'source="chrome_install.log" AND (extension_install OR .crx) NOT domain="chrome.google.com"'🔗 References
- https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html
- https://crbug.com/1267661
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
- https://security.gentoo.org/glsa/202208-25
- https://www.debian.org/security/2022/dsa-5046
- https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop.html
- https://crbug.com/1267661
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/
- https://security.gentoo.org/glsa/202208-25
- https://www.debian.org/security/2022/dsa-5046
