Google Details iOS, Chrome, IE Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-1879 | Universal XSS in Apple WebKit on iOS, iPadOS, and watchOS (Actively Exploited) CVE-2021-1879 is a universal cross-site scripting (UXSS) flaw in the WebKit browser engine affecting iOS, iPadOS, and watchOS, caused by an object-lifetime management error. An attacker can trigger it by convincing a user to process maliciously crafted web content (e.g., visiting an attacker-controlled page in Safari or another WebKit-based browser), allowing the attacker to bypass the same-origin policy and read or modify content of other sites in the browser. Successful exploitation is rated Medium severity (CVSS 6.1) because it requires user interaction, but it can leak sensitive data such as cookies, session tokens, or page content. Any user of an iPhone, iPad, or Apple Watch running software older than iOS 12.5.2, iOS 14.4.2/iPadOS 14.4.2, or watchOS 7.3.3 is affected. Apple reported that the issue may have been actively exploited in the wild at the time of patching, it is on the CISA Known Exploited Vulnerabilities catalog (added 2021-11-03), and public reporting tied its use to targeted campaigns (including Russian SVR-linked operations), though no public proof-of-concept is known. Do: Update devices to iOS 12.5.2 (older devices) or iOS 14.4.2/iPadOS 14.4.2, and Apple Watch devices to watchOS 7.3.3, per Apple's instructions. Because exploitation requires loading malicious web content in WebKit, avoid following untrusted web links on unpatched devices until updated; verify fleet-wide OS versions and confirm the fix, since this CVE is on the CISA KEV catalog with patching required. Check logs or browser history for signs of visits to attacker-controlled sites on devices that have since been updated, as no public proof-of-concept exists to test against. | 6.1 | 7% | KEV |
| masshundreds of millions of devices (Apple's active iPhone/iPad/watchOS install base was on the order of 1+ billion when patched; all unpatched devices are exposed… | |
| CVE-2021-21166 | Race Condition Heap Corruption in Google Chromium (Chrome, Edge, Opera) Google Chromium contains a race condition (CWE-362) that can lead to heap corruption (CWE-122) when the browser processes a crafted HTML page, meaning an attacker can trigger the flaw simply by getting a user to visit an attacker-controlled or malicious webpage. Successful exploitation of the heap corruption could crash the browser and potentially allow the attacker to execute code within the affected browser process. Because the vulnerable code is in the Chromium engine itself, all Chromium-based browsers are potentially affected, including Google Chrome, Microsoft Edge, Opera, and other derived browsers, across desktop and mobile fleets. CISA added CVE-2021-21166 to the Known Exploited Vulnerabilities catalog on 2021-11-03, confirming the flaw is being exploited in the wild, though ransomware use is unknown and no public proof-of-concept is available. EPSS currently assigns a 26.7% probability of exploitation within 30 days (98th percentile), and CVSS scoring has not yet been published. Do: Apply the latest patched releases of all Chromium-based browsers in use (Chrome, Edge, Opera, and any derived browsers) per vendor instructions, as required by CISA's KEV listing. Prioritize managed endpoints and any systems where users browse untrusted or internet-facing websites, verify fleet-wide browser versions after updating, and monitor CISA/vendor advisories for ransomware-associated activity since that linkage is currently unknown. | 8.8 | 27% | KEV |
| massbillions of users and installations (Chromium powers Chrome, Edge, Opera and many other browsers) | |
| CVE-2021-30551 | V8 Type Confusion Zero-Day in Google Chrome (CVE-2021-30551), Exploited in the Wild CVE-2021-30551 is a type confusion flaw (CWE-843) in the V8 JavaScript engine used by Google Chrome and Chromium, which can lead to heap corruption. An attacker triggers it by persuading a user to open a specially crafted HTML page — the browser bug requires user interaction but no privileges or authentication. Successful exploitation could allow a remote attacker to execute code or otherwise corrupt the browser process, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.8). Anyone running Google Chrome prior to 91.0.4472.101, including Chromium-based packages such as Fedora's chromium, is affected. The flaw was exploited as a zero-day before the fix was released, with Google attributing recent Chrome zero-day attacks including this issue to campaigns against Armenian targets linked to a commercial spyware vendor, and it is listed in CISA's Known Exploited Vulnerabilities catalog. Do: Update Google Chrome to 91.0.4472.101 or later (via chrome://settings/help) and update Fedora's chromium package to the patched build, then verify the version in chrome://version. Fedora/Chromium administrators should apply vendor updates per CISA KEV guidance. Until patched, treat web browsing as a risk vector and avoid opening untrusted links, since exploitation requires loading a crafted web page. | 8.8 | 65% | KEV PoC |
| masshundreds of millions to billions of Chrome/Chromium installs worldwide (Chrome is the world's dominant browser) | |
| CVE-2021-33742 | Out-of-Bounds Write RCE in Microsoft Windows MSHTML Engine (CVE-2021-33742) A remote code execution vulnerability exists in the Microsoft Windows MSHTML Platform — the Internet Explorer/Trident rendering engine that Windows components and applications invoke to display web content — caused by an out-of-bounds write (CWE-787). An attacker triggers it by persuading a user to open attacker-controlled content, such as a crafted document or web page that causes MSHTML to render a remote URL; no privileges are required, but user interaction is needed and the attack is rated high complexity. Successful exploitation runs attacker code in the context of the logged-in user, potentially allowing installation of programs, viewing/changing/deleting data, or creating new accounts with the victim's rights. The affected range spans Windows 7, 8.1, RT 8.1, Windows 10 versions 1507 through 21H1, and Windows Server 2008 and 2012 — essentially the entire supported Windows installed base at the time of disclosure. Exploitation is confirmed in the wild: Microsoft disclosed the flaw as used in limited targeted attacks, CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03 (ransomware use unknown), and EPSS assigns a 59.4% 30-day exploitation probability (99th percentile). Do: Apply Microsoft's security update for CVE-2021-33742, delivered via the July 2021 cumulative Windows updates (and later), to all affected Windows 7/8.1/RT 8.1/10 clients and Windows Server 2008/2012 hosts, prioritizing internet-exposed systems and per CISA's required action. Because exploitation requires user interaction, treat unsolicited documents and links with caution until systems are patched. No public proof-of-concept is known, but the KEV listing confirms real-world targeted exploitation, so assume active scanning/attacks and verify patch status across the estate. | 7.5 | 59% | KEV |
| masson the order of 1 billion+ Windows installations |
Full article608 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananJul 15, 2021
Threat intelligence researchers from Google on Wednesday shed more light on four in-the-wild zero-days in Chrome, Safari, and Internet Explorer browsers that were exploited by malicious actors in different campaigns since the start of the year.
What's more, three of the four zero-days were engineered by commercial providers and sold to and used by government-backed actors, contributing to an uptick in real-world attacks. The list of now-patched vulnerabilities is as follows -
- CVE-2021-1879: Use-After-Free in QuickTimePluginReplacement (Apple WebKit)
- CVE-2021-21166: Chrome Object Lifecycle Issue in Audio
- CVE-2021-30551: Chrome Type Confusion in V8
- CVE-2021-33742: Internet Explorer out-of-bounds write in MSHTML
Both Chrome zero-days — CVE-2021-21166 and CVE-2021-30551 — are believed to have been used by the same actor, and were delivered as one-time links sent via email to targets located in Armenia, with the links redirecting unsuspecting users to attacker-controlled domains that masqueraded as legitimate websites of interest to the recipients.
The malicious websites took charge of fingerprinting the devices, including collecting system information about the clients, before delivering a second-stage payload.
When Google rolled out a patch for CVE-2021-30551, Shane Huntley, Director of Google's Threat Analysis Group (TAG), revealed that the vulnerability was leveraged by the same actor that abused CVE-2021-33742, an actively exploited remote code execution flaw in Windows MSHTML platform that was addressed by Microsoft as part of its Patch Tuesday update on June 8.
The two zero-days were provided by a commercial exploit broker to a nation-state adversary, which used them in limited attacks against targets in Eastern Europe and the Middle East, Huntley previously added.
Now according to a technical report published by the team, all the three zero-days were "developed by the same commercial surveillance company that sold these capabilities to two different government-backed actors," adding the Internet Explorer flaw was used in a campaign targeting Armenian users with malicious Office documents that loaded web content within the web browser.
Google did not disclose the identities of the exploit broker or the two threat actors that used the vulnerabilities as part of their attacks.
SolarWinds Hackers Exploited iOS Zero-Day
The Safari zero-day, in contrast, concerned a WebKit flaw that could enable adversaries to process maliciously crafted web content that may result in universal cross-site scripting attacks. The issue was rectified by Apple on March 26, 2021.
Attacks leveraging CVE-2021-1879, which Google attributed to a "likely Russian government-backed actor," were executed by means of sending malicious links to government officials over LinkedIn that, when clicked from an iOS device, redirected the user to a rogue domain that served the next-stage payloads.
It's worth noting that the offensive also mirrors a wave of targeted attacks unleashed by Russian hackers tracked as Nobelium, which was found abusing the vulnerability to strike government agencies, think tanks, consultants, and non-governmental organizations as part of an email phishing campaign.
Nobelium, a threat actor linked to the Russian Foreign Intelligence Service (SVR), is also suspected of orchestrating the SolarWinds supply chain attack late last year. It's known by other aliases such as APT29, UNC2452 (FireEye), SolarStorm (Unit 42), StellarParticle (Crowdstrike), Dark Halo (Volexity), and Iron Ritual (Secureworks).
"Halfway into 2021, there have been 33 zero-day exploits used in attacks that have been publicly disclosed this year — 11 more than the total number from 2020," TAG researchers Maddie Stone and Clement Lecigne noted. "While there is an increase in the number of zero-day exploits being used, we believe greater detection and disclosure efforts are also contributing to the upward trend."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2021/07/google-details-ios-chrome-ie-zero-day.html