Experts from the Chinese cybersecurity company Qihoo 360 have reported to Google another sandbox escape vulnerability (CVE-2021-21194) affecting the Chrome web browser. The tech giant awarded the researchers Leecraso and Guang Gong from the 360 Alpha Lab at Qihoo 360 with a $20,000 payout
Google addressed the vulnerability, along with other seven issues, this week with the release of an update for version 89.
The CVE-2021-21194 flaw, rated as high severity, is a use after free in screen capture that could be exploited to escape the Chrome sandbox. Chaining the issue with a renderer flaw, an attacker can escape the sandbox and execute arbitrary code in the targeted device.
“Leecraso told SecurityWeek that the vulnerability, tracked as CVE-2021-21194, can be exploited to escape the Chrome sandbox. If exploited in combination with a renderer bug, it can allow an attacker to remotely execute arbitrary code outside the Chrome sandbox on the targeted user’s device.” reported Security Week.
Prudhvikumar Bommana from Google Chrome team said that many of security bugs discovered by its team are detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.
In October 2020, Leecraso and Guang Gong earned $15000 for reporting to Google another Use after free in user interface of the Chrome browser (CVE-2020-16004). In November 2020, Google released Chrome 86.0.4240.183 for Windows, Mac, and Linux to fix 10 issues including the CVE-2020-16004 flaw.
If you want to receive the weekly Security Affairs Newsletter for free subscribe here.
(SecurityAffairs – hacking, Google)