CVE-2021-21174 is a high-severity vulnerability in Google Chrome versions prior to 89.0.4389.72, affecting various Debian and Fedora distributions. This flaw, categorized as an "inappropriate implementation in Referrer," allows a remote attacker to bypass navigation restrictions through a specially crafted HTML page. With a CVSS score of 8.8, it carries high impacts on confidentiality, integrity, and availability, requiring user interaction but being network-exploitable with low attack complexity. While there is no known public exploit code or Metasploit/Nuclei modules, it was reportedly an actively exploited zero-day at the time of its discovery, garnering significant community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 89.0.4389.72CPE matchmatch criteria | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | ||
32CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | ||
33CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | ||
34CPE matchmatch criteria | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | ||
10.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.