Loading vulnerability…
CVE-2021-21123 is a vulnerability in Google Chrome's File System API prior to version 88.0.4324.96, where insufficient data validation allowed a remote attacker to bypass filesystem restrictions by leveraging a crafted HTML page. The vulnerability arises from improper validation of input data within the File System API, enabling unauthorized access to restricted filesystem areas.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository provides proof-of-concept (PoC) code for several vulnerabilities (CVE-2021-21123, CVE-2021-21129, CVE-2021-21130, CVE-2021-21131, CVE-2021-21141, CVE-2021-21172) in the Google Chrome File System Access API, affecting versions 86, 87, and 88 on Windows, Mac, and Linux. The main exploit leverages HTML and JavaScript to abuse the File System Access API, specifically the showSaveFilePicker and getFileHandle methods, to create and save files with misleading or dangerous extensions (e.g., .jpg.lnk) or content. This can trick users into saving and potentially executing malicious files, such as Windows shortcut (.lnk) files that could run arbitrary code. The repository includes two main HTML files: example_showSaveFilePicker.html demonstrates various ways to spoof file extensions and descriptions in the Save As dialog, while example_getFileHandle.html shows how to save .lnk files directly to a user-selected folder. The PoC is educational and requires user interaction in a vulnerable Chrome version. No actual malicious files are included, but the code demonstrates how an attacker could deliver such files. The README provides detailed context, CVE references, and links to further documentation.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
No public activity tracked yet. Mallory keeps watching.
No public activity observed for this vulnerability.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.