CVE-2021-41146
📋 TL;DR
This vulnerability allows arbitrary code execution on Windows systems where qutebrowser is installed and registered as a URL handler. Attackers can craft malicious qutebrowserurl: links that execute browser commands like :spawn or :debug-pyeval, leading to full system compromise. Only Windows installations with qutebrowser registered as a URL handler are affected.
💻 Affected Systems
- qutebrowser
📦 What is this software?
Qutebrowser by Qutebrowser
Qutebrowser by Qutebrowser
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with attacker gaining complete control over the Windows system, allowing data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Local privilege escalation or remote code execution when users click malicious links in emails, documents, or web pages.
If Mitigated
No impact if qutebrowser is not registered as URL handler or if patched version is installed.
🎯 Exploit Status
Exploitation requires user interaction (clicking malicious link) but the exploit chain is straightforward once the link is triggered.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v2.4.0
Vendor Advisory: https://github.com/qutebrowser/qutebrowser/security/advisories/GHSA-vw27-fwjf-5qxm
Restart Required: Yes
Instructions:
1. Download qutebrowser v2.4.0 or later from official sources. 2. Run the installer to upgrade existing installation. 3. Restart qutebrowser and any applications that might use the URL handler.
🔧 Temporary Workarounds
Unregister qutebrowser URL handler
windowsRemove qutebrowser as registered URL handler to prevent exploitation
reg delete "HKCU\Software\Classes\qutebrowserurl" /f
reg delete "HKLM\Software\Classes\qutebrowserurl" /f
Use portable version
windowsUse portable qutebrowser version that doesn't register URL handler
🧯 If You Can't Patch
- Unregister qutebrowser URL handler using registry commands
- Use alternative browser until patching is possible
- Implement application control to block qutebrowser execution
🔍 How to Verify
Check if Vulnerable:
Check qutebrowser version with 'qutebrowser --version' and verify if between v1.7.0 and v2.3.x. Check Windows registry for qutebrowserurl handler.Check Version:
qutebrowser --versionVerify Fix Applied:
Verify qutebrowser version is v2.4.0 or later. Check that URL handler behavior is restricted.📡 Detection & Monitoring
Log Indicators:
- Unusual qutebrowser command execution
- qutebrowserurl: protocol handler activations
- Suspicious :spawn or :debug-pyeval commands in browser logs
Network Indicators:
- Outbound connections from qutebrowser to unexpected destinations
- Downloads initiated by qutebrowser without user interaction
SIEM Query:
process_name:"qutebrowser.exe" AND (command_line:":spawn" OR command_line:":debug-pyeval")🔗 References
- https://github.com/qutebrowser/qutebrowser/commit/8f46ba3f6dc7b18375f7aa63c48a1fe461190430
- https://github.com/qutebrowser/qutebrowser/security/advisories/GHSA-vw27-fwjf-5qxm
- https://github.com/qutebrowser/qutebrowser/commit/8f46ba3f6dc7b18375f7aa63c48a1fe461190430
- https://github.com/qutebrowser/qutebrowser/security/advisories/GHSA-vw27-fwjf-5qxm
