Issued: Sunday, 18 July, 2021 |
Last Revision: Sunday, 18 July, 2021 |
Vendor: |
Product: |
Severity Level: |
Summary:
Vulnerability related to Google Chrome has been exploited in a wild, threat actors have used both the Chrome and Windows exploits to gain a foothold in the targeted system, the stager module downloads and executes a more complex malware dropper from a remote server, We already had shared Windows related vulnerabilities in Microsoft July Update Fixes Multiple Zero-Days Exploited
Both CVE-2021-21166 and CVE-2021-30551 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2021-21166 was reported by Alison Huffman from the Microsoft Browser Vulnerability Research team on February 11 and is described as an "object lifecycle issue in audio."
CVE-2021-30551 The vulnerability was discovered by Sergei Glazunov of Google Project Zero in first week of June 2021. This vulnerability is related to a Windows flaw, that Google researchers discovered and Microsoft releases patchon 8 th June 2021.
Shane Huntley, Director of Google's Threat Analysis Group, says that this zero-day was utilized by the same threat actors using the Windows CVE-2021-33742 zero-day fixed by Microsoft
Recommendation:
• Apply the stable channel update provided by Google to vulnerable systems immediately
after appropriate testing.
• Run all software as a non-privileged user (one without administrative privileges) to diminish
the effects of a successful attack.
• Remind users not to visit un-trusted websites or follow links provided by unknown or untrusted sources.
• Inform and educate users regarding the threats posed by hypertext links contained in emails
or attachments especially from un-trusted sources.
• Apply the Principle of Least Privilege to all systems and services
References: