Vulnerability Spotlight: Use-after-free vulnerability in Google Chrome could lead to code execution

Wednesday, November 17, 2021 14:59

Marcin Towalski of Cisco Talos discovered this vulnerability.

Cisco Talos recently discovered an exploitable use-after-free vulnerability in Google Chrome.

Google Chrome is a cross-platform web browser — and Chromium is the open-source version of the browser that other software developers use to build their browsers, as well.TALOS-2021-1348 (CVE-2021-30602) is a use-after-free vulnerability in Chrome's WebRTC functionality. A specially crafted web page can trigger the reuse of previously freed memory, which can lead to arbitrary code execution. The victim would need to open a malicious website to trigger this vulnerability.

Cisco Talos worked with Google to ensure that this issue is resolved and an update is available for affected customers, all in adherence to Cisco’s vulnerability disclosure policy.

Users are encouraged to update these affected products as soon as possible: Google Chrome, versions 91.0.4472.114 (Stable) and 93.0.4575.0 (Canary). Talos tested and confirmed these versions of Chrome could be exploited by this vulnerability.

The following SNORTⓇ rules will detect exploitation attempts against this vulnerability: 57938 and 57939. Additional rules may be released in the future and current rules are subject to change, pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.