CVE-2021-21107

Use after free in drag and drop in Google Chrome on Linux prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to…

published January 8, 2021

CVSS
—
EPSS
1%
Percentile
66.1
In the wild
Unconfirmed
What it is

⚠️ A crafty use-after-free flaw in Google Chrome on Linux means an attacker could potentially leap out of the sandbox with just a malicious HTML page! 🕵️‍♂️ Think of it like a magician who gets to escape from their box before the trick is done. If handled poorly, they could waltz out and wreak havoc instead of captivating the audience! 🎩✨ If exploited, this vulnerability could allow an attacker to perform a sandbox escape, meaning they could gain elevated privileges on the system. It's a surprising turn of events that could lead to unauthorized access to sensitive data or control over your machine!

Put simply

Think of it like a magician who gets to escape from their box before the trick is done. If handled poorly, they could waltz out and wreak havoc instead of captivating the audience! 🎩✨ In Google Chrome versions prior to 87.0.4280.141, a use-after-free vulnerability was found in the drag-and-drop feature, allowing a compromised renderer process to manipulate memory and potentially escape its restrictions.

What to do

If exploited, this vulnerability could allow an attacker to perform a sandbox escape, meaning they could gain elevated privileges on the system. It's a surprising turn of events that could lead to unauthorized access to sensitive data or control over your machine! To safeguard against this, update Google Chrome to version 87.0.4280.141 or later immediately. Ensure that your systems are equipped with the latest security patches and regularly review your software for updates! You've got this! Stay vigilant, and keep your systems secure! 🛡️

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01130 · 66.1th percentile
Published
2021-01-08T17:56Z
EPSS history
Timeline
  • 08 JAN 17:56Z
    Use after free in drag and drop in Google Chrome on Linux prior to 87.0.4280.141 allowed a remote attacker who had compromised the renderer process to…
    cvelistv5