Advisories

CERT-In Advisory CIAD-2021-0038

Multiple Vulnerabilities in multiple Browsers

Original Issue Date: October 01, 2021

Severity Rating: High

Systems Affected

Google Chrome version prior to 94.0.4606.71 for Windows, Mac and Linux
Microsoft Edge (Chromium-based)versions prior to 94.0.992.38

Overview

Multiple vulnerabilities have been reported in Google Chrome & Microsoft Edge which could be exploited by a remote attacker to execute arbitrary code or obtain sensitive information on the targeted system.

Description

1. Use After Free Vulnerabilities ( CVE-2021-37974 CVE-2021-37975 )

These vulnerabilities exist due toa use-after-free error in Safe Browsing and V8 browser engine component of the affected software. A remote attacker could exploit these vulnerabilities by creating a specially crafted web page and persuading an unsuspected user to visit the page, triggering a use-after-free error. Successful exploitation of these vulnerabilities could allow the attacker to execute arbitrary code on the targeted system.

2. Information Disclosure Vulnerability ( CVE-2021-37976 )

This vulnerability is due to information leak in core of the affected software. A remote attacker could exploit this vulnerability by persuading an unsuspected user to open a specially crafted web page. Successful exploitation of this vulnerability could allow the attacker to access sensitive information on the targeted system.

Note: Two vulnerabilities CVE-2021-37975 and CVE-2021-37976 are currently exploited in the wild, users are advised to apply patches urgently.

Solution

Upgrade to Google chrome version 94.0.4606.71 for Windows, Mac, and Linux
https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_30.html
Upgrade to Microsoft Edge version 94.0.992.38
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-37974
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-37975
https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-37976

Vendor Information

Google Chrome
https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_30.html
Microsoft
https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security

References

Google Chrome
https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_30.html

Microsoft
https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security

CVE Name
CVE-2021-37974
CVE-2021-37975
CVE-2021-37976

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India