PT-2021-5088

CVE-2021-38020

Published

2021-11-15

Updated

2024-06-15

Description by

CVSS 2.0

6.4

Medium

MetricsAV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 96.0.4664.45

Description The issue concerns insufficient policy enforcement in the contacts picker component of Google Chrome on Android. This allows a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page, potentially bypassing security restrictions and gaining unauthorized access to protected information.

Recommendations For versions prior to 96.0.4664.45, update to version 96.0.4664.45 or later to resolve the issue.

Exploitability

Fix

Researchers

Lbherrera

Luan Herrera

Vendors

Affected products

Weakness enumeration

CWE-264

Related identifiers

CVE-2021-38020