CVE-2021-21141

Description

Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass file extension policy via a crafted HTML page.

Risk Information

Base Score

6.5

MODERATE

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

EPSS Score

Exploitation Probability

4.042

Associated Vulnerability

Vulnerability	OS Platform
Multiple vulnerabilities fixed in Google Chrome (x64) (88.0.4324.96)	Windows
Multiple vulnerabilities fixed in Google Chrome (88.0.4324.96)	Windows
Multiple vulnerabilities fixed in Google Chrome (x64) (88.0.4324.104)	Windows
Multiple vulnerabilities fixed in Google Chrome (88.0.4324.104)	Windows
Multiple vulnerabilities are fixed in Google Chrome for Mac 88.0.4324.104	Mac
Multiple vulnerabilities are fixed in Google Chrome For Mac (88.0.4324.96)	Mac
Multiple vulnerabilities fixed in Google Chrome (88.0.4324.96) (For Debian)	Linux
Multiple vulnerabilities fixed in Google Chrome (88.0.4324.96) (For Centos)	Linux
Multiple vulnerabilities fixed in Google Chrome (88.0.4324.96) (For RedHat)	Linux
Multiple vulnerabilities fixed in Google Chrome (88.0.4324.96) (For Suse)	Linux
Multiple vulnerabilities fixed in Google Chrome (88.0.4324.96) (For Ubuntu)	Linux
chromium security update(DSA-4846-1) chromium_88.0.4324.146-1~deb10u1_i386.deb	Linux
chromium security update(DSA-4846-1) chromium_88.0.4324.146-1~deb10u1_amd64.deb	Linux

Patch Details

Click to see the patches provided by ManageEngine for this CVE

Patch ID	Patch Description
PATCH-317970	Google Chrome (x64) (88.0.4324.96)
PATCH-317969	Google Chrome (88.0.4324.96)
PATCH-318015	Google Chrome (x64) (88.0.4324.104)
PATCH-318014	Google Chrome (88.0.4324.104)
PATCH-611995	Google Chrome for Mac (140.0.7339.132 , 140.0.7339.133)
PATCH-609673	Google Chrome for Mac (132.0.6834.83, 132.0.6834.84)

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234