CVE-2021-21123

Insufficient data validation in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.

Affected

Google · Chrome

CVSS v3.1 NVD

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

CVSS v2.0 NVD

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

10.91% chance of exploitation in the next 30 days, 96th percentile

Published

2021-02-09

Updated

2024-08-03

Proof-of-concept exploits (1)

• Puliczek/CVE-2021-21123-PoC-Google-Chrome176★ · 2021-03-22

Security advisories

• https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html
• https://crbug.com/1137247
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21123

References

• CVE Record
• NVD entry

Related

• CVE-2021-4104
• CVE-2021-44228
• CVE-2021-45046
• CVE-2021-45105
• CVE-2022-0337