Pierluigi Paganini April 15, 2021

For the second time in a week, a Chromium zero-day remote code execution exploit code has been released on Twitter, multiple browsers impacted.

A new Chromium zero-day remote code execution exploit has been released on Twitter this week, like the previous one that affects current versions of Google Chrome, Microsoft Edge, and likely other Chromium-based browsers.

The exploit for the new vulnerability was publicly released by a security researcher that goes online with the handle frust. The exploit demonstrated by the expert triggers the issue to open the Windows Notepad application.

Early this week, the Indian security researcher Rajvardhan Agarwal has publicly released a proof-of-concept exploit code for a recently discovered vulnerability that affects Google Chrome, Microsoft Edge, and other Chromium-based browsers (i.e. Opera, Brave).

The researchers uploaded the PoC code on GitHub and announced its availability via Twitter. According to The Record, the PoC code released by the experts was the same exploited by the security duo composed of Bruno Keith (@bkth_) & Niklas Baumstark (@_niklasb) of Dataflow during the Pwn2Own 2021 hacking contest.

Google addressed this issue with the release of the Chrome 89.0.4389.128 version.

Both remote code execution vulnerabilities disclosed this week could not escape Chromium’s sandbox, which means that attackers have to chain them with a sandbox escape exploit to executing arbitrary code on the underlying system.

Since January, Google has already addressed other zero-day issues in Chrome that have been actively exploited in the wild, including CVE-2021-21148, CVE-2021-21166, and CVE-2021-21193.

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Chromium zero-day)

[adrotate banner=”5″]

[adrotate banner=”13″]