CVSS: 9.6EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21121
https://notcve.org/view.php?id=CVE-2021-21121
Use after free in Omnibox in Google Chrome on Linux prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Un uso de la memoria previamente liberada en Omnibox en Google Chrome en Linux versiones anteriores a 88.0.4324.96, permitía a un atacante remoto llevar a cabo potencialmente un escape del sandbox por medio de una página HTML diseñada • https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html https://crbug.com/1161143 https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21121 • CWE-416: Use After Free •
CVSS: 9.6EPSS: 0%CPEs: 2EXPL: 0CVE-2021-21124
https://notcve.org/view.php?id=CVE-2021-21124
Potential user after free in Speech Recognizer in Google Chrome on Android prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. Un potencial uso de la memoria previamente liberada en Speech Recognizer en Google Chrome en Android versiones anteriores a 88.0.4324.96, permitió a un atacante remoto llevar a cabo potencialmente un escape del sandbox por medio de una página HTML diseñada • https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html https://crbug.com/1131346 https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21124 • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 1CVE-2021-21139
https://notcve.org/view.php?id=CVE-2021-21139
Inappropriate implementation in iframe sandbox in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. Una implementación inapropiada en iframe sandbox en Google Chrome versiones anteriores a 88.0.4324.96, permitió a un atacante remoto omitir las restricciones de navegación por medio de una página HTML diseñada • https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop_19.html https://crbug.com/937131 https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-21139 • CWE-1021: Improper Restriction of Rendered UI Layers or Frames •
CVSS: 9.6EPSS: 0%CPEs: 2EXPL: 0CVE-2020-16045
https://notcve.org/view.php?id=CVE-2020-16045
Use after Free in Payments in Google Chrome on Android prior to 87.0.4280.66 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. Un Uso de la Memoria Previamente Liberada en Payments en Google Chrome en Android versiones anteriores de 87.0.4280.66 permitía a un atacante remoto que había comprometido el proceso del renderizador llevar a cabo potencialmente un escape del sandbox por medio de una página HTML diseñada • https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html https://crbug.com/1125614 • CWE-416: Use After Free •
CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-21261 – Flatpak sandbox escape via spawn portal
https://notcve.org/view.php?id=CVE-2021-21261
A bug was discovered in the `flatpak-portal` service that can allow sandboxed applications to execute arbitrary code on the host system (a sandbox escape). This sandbox-escape bug is present in versions from 0.11.4 and before fixed versions 1.8.5 and 1.10.0. ... Flatpak es un sistema para crear, distribuir y ejecutar aplicaciones de escritorio en sandbox en Linux. Se detectó un fallo en el servicio "flatpak-portal" que puede permitir que las aplicaciones en sandbox ejecuten código arbitrario en el sistema host (un escape del sandbox). Este fallo de escape del sandbox está presente en las versiones 0.11.4 y anteriores a las versiones reparadas 1.8.5 y 1.10.0. • https://github.com/flatpak/flatpak/commit/6d1773d2a54dde9b099043f07a2094a4f1c2f486 https://github.com/flatpak/flatpak/commit/6e5ae7a109cdfa9735ea7ccbd8cb79f9e8d3ae8b https://github.com/flatpak/flatpak/commit/aeb6a7ab0abaac4a8f4ad98b3df476d9de6b8bd4 https://github.com/flatpak/flatpak/commit/cc1401043c075268ecc652eac557ef8076b5eaba https://github.com/flatpak/flatpak/releases/tag/1.8.5 https://github.com/flatpak/flatpak/security/advisories/GHSA-4ppf-fxf6-vxg2 https://security.gentoo.org/glsa/202101-21 https://www.debian.org/security/2021/ • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •