Vulnerability Spotlight: Heap buffer overflow condition in Google Chrome could lead to code execution
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-37979 | heap buffer overflow in WebRTC in Google Chrome prior to 94.0.4606.81 allowed a remote attacker who convinced a user to browse to a malicious website to potenti heap buffer overflow in WebRTC in Google Chrome prior to 94.0.4606.81 allowed a remote attacker who convinced a user to browse to a malicious website to potentially exploit heap corruption via a crafted HTML page. NVD description · AI analysis pending | 8.8 | 2% | PoC |
| — |
Full article233 words · extracted from blog.talosintelligence.com · click to collapse
Tuesday, January 11, 2022 10:07
Marcin Towalski of Cisco Talos discovered this vulnerability.
Cisco Talos recently discovered an exploitable heap-based buffer overflow vulnerability in Google Chrome.
Google Chrome is a cross-platform web browser — and Chromium is the open-source version of the browser that other software developers use to build their browsers, as well. This specific vulnerability exists in WebRTC, a technology that enables websites to capture and stream audio or video and other data between browsers.
TALOS-2021-1372 (CVE-2021-37979) is a heap-based buffer overflow vulnerability that triggers if the user opens a specially crafted web page in Chrome. That page could trigger a heap buffer overflow and memory corruption error in the application and buffer overflow, which could lead to code execution.
Cisco Talos worked with Google to ensure that this issue is resolved and an update is available for affected customers, all in adherence to Cisco’s vulnerability disclosure policy.
Users are encouraged to update these affected products as soon as possible: Google Chrome, versions 92.0.4515.159 (Stable) and 95.0.4623.0 (Canary). Talos tested and confirmed these versions of Chrome could be exploited by this vulnerability.
The following SNORTⓇ rules will detect exploitation attempts against this vulnerability: 58108 and 58109. Additional rules may be released in the future and current rules are subject to change, pending additional vulnerability information. For the most current rule information, please refer to your Firepower Management Center or Snort.org.
Text extracted automatically; images, tables and formatting may be missing. Original: https://blog.talosintelligence.com/vuln-spotlight-chrome-heap/