VulnerabilitycriticalExploited in the wild

Google Releases Urgent Chrome Update to Patch 2 Actively Exploited 0

The Hacker Newsby @TheHackersNewsOct 29, 2021 · 04:08 UTC (Oct 29, 2021)1 min read1 · 1 read

Read at thehackernews.com

Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat

CVEs: CVE-2021-38000 CVE-2021-38003 CVE-2021-38002 CVE-2021-21148 CVE-2021-21166 CVE-2021-21193 CVE-2021-21206 CVE-2021-21220 CVE-2021-21224 CVE-2021-30551 CVE-2021-30554 CVE-2021-30563 CVE-2021-30632 CVE-2021-30633 CVE-2021-37973 CVE-2021-37975 CVE-2021-37976

Tags: cve-2021-38000 cve-2021-38003 cve-2021-38002 cve-2021-21148 cve-2021-21166 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2021-21148	Heap Buffer Overflow in Google Chrome/Chromium V8 (CVE-2021-21148)	8.8	20%	KEV	Feb 9, 2021 KEV Nov 3, 2021
CVE-2021-21166	Race Condition Heap Corruption in Google Chromium (Chrome, Edge, Opera)	8.8	24%	KEV	Mar 9, 2021 KEV Nov 3, 2021
CVE-2021-21193	Use-After-Free in Google Chromium Blink Engine Actively Exploited	8.8	10%	KEV	Mar 16, 2021 KEV Nov 3, 2021
CVE-2021-21206	Use-After-Free in Google Chrome Blink Engine Exploited in the Wild	8.8	9%	KEV	Apr 26, 2021 KEV Nov 3, 2021
CVE-2021-21224 +1 related CVE CVE-2021-21220	Type Confusion RCE in Google Chrome/Chromium V8 JavaScript Engine	8.8	84%	KEVPoC	Apr 26, 2021 KEV Nov 3, 2021
CVE-2021-30551	V8 Type Confusion Zero-Day in Google Chrome (CVE-2021-30551), Exploited in the Wild	8.8	65%	KEVPoC	Jun 15, 2021 KEV Nov 3, 2021
CVE-2021-30554	Use-After-Free in Google Chrome WebGL Exploited in the Wild (CVE-2021-30554)	8.8	7%	KEV	Jul 2, 2021 KEV Nov 3, 2021
CVE-2021-30563	Type Confusion in Google Chrome V8 Engine Exploited in the Wild	8.8	9%	KEV	Aug 3, 2021 KEV Nov 3, 2021
CVE-2021-30632 +1 related CVE CVE-2021-37975	Out-of-Bounds Write in Google Chrome V8 JavaScript Engine (CVE-2021-30632)	8.8	63%	KEV	Oct 8, 2021 KEV Nov 3, 2021
CVE-2021-30633	Use-After-Free Sandbox Escape in Chromium Indexed DB API	9.6	33%	KEV	Oct 8, 2021 KEV Nov 3, 2021
CVE-2021-37973	Use-After-Free Sandbox Escape in Google Chrome/Chromium Portals	9.6	12%	KEV	Oct 8, 2021 KEV Nov 3, 2021
CVE-2021-37976	Information Disclosure in Google Chrome/Chromium Memory Implementation (CVE-2021-37976)	6.5	20%	KEVPoC	Oct 8, 2021 KEV Nov 3, 2021
CVE-2021-38000	Improper Input Validation in Google Chrome for Android Allows Forced URL Navigation	6.1	5%	KEVPoC	Nov 23, 2021 KEV Nov 3, 2021
CVE-2021-38002	Use after free in Web Transport in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML…	9.6	<1%		Nov 23, 2021
CVE-2021-38003	Memory Corruption in Chromium V8 JSON.stringify Affects Chrome, Edge, Opera	8.8	39%	KEVPoC	Nov 23, 2021 KEV Nov 3, 2021

From the original article

1 min read at thehackernews.com

Google on Thursday rolled out an emergency update for its Chrome web browser, including fixes for two zero-day vulnerabilities that it says are being actively exploited in the wild. Tracked as CVE-2021-38000 and CVE-2021-38003 , the weaknesses relate to insufficient validation of untrusted input in a feature called Intents as well as a case of inappropriate implementation in V8 JavaScript and WebAssembly engine.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.