CVE-2021-4324 — Google Chrome vulnerability

16 documents6 sources
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 65.69%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Google ChromeDebian ChromiumGoogle Chrome Chrome+1 more
Timeline
PublishedJul 29

Description

Insufficient policy enforcement in Google Update in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to read arbitrary files via a malicious file. (Chromium security severity: Medium)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5google/chrome90.0.4430.93 — 90.0.4430.93
▶NVDgoogle/chrome< 90.0.4430.93

🔴Vulnerability Details

1
GHSA
GHSA-fhhm-8962-7qcw: Insufficient policy enforcement in Google Update in Google Chrome prior to 90↗2023-07-29
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Exchange 2019 - Server-Side Request Forgery↗2021-03-14
▶

📋Vendor Advisories

13
Chrome
Stable Channel Update for Desktop: CVE-2021-21228↗2021-04-26
▶
Microsoft
Chromium CVE-2021-21155: Heap buffer overflow in Tab Strip↗2021-02-09
▶
Microsoft
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability↗2021-02-09
▶
Microsoft
Chromium: CVE-2021-21150 Use after free in Downloads↗2021-02-09
▶
Microsoft
Chromium CVE-2021-21156: Heap buffer overflow in V8↗2021-02-09
▶