CVE-2021-21127: 
Google Chrome vulnerability analysis and mitigation

Insufficient policy enforcement in extensions in Google Chrome prior to version 88.0.4324.96 allowed a remote attacker to bypass content security policy via a crafted Chrome Extension. The vulnerability was discovered and reported on August 12, 2020, by Jasminder Pal Singh from Web Services Point WSP, Kotkapura (Chrome Release).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges, but does require user interaction. The impact potential is high across confidentiality, integrity, and availability (NVD).

The vulnerability could allow an attacker to bypass content security policy through a specially crafted Chrome Extension, potentially compromising the security boundaries set by the browser. This could lead to unauthorized access to sensitive information, manipulation of browser behavior, and potential execution of malicious code (NVD).

The vulnerability requires user interaction and can be exploited remotely through network access. While specific exploit details are not publicly available, the bug has been documented in the Chrome bug tracker and has been assigned a medium severity rating by the Chrome security team (Chrome Release).

The vulnerability was patched in Chrome version 88.0.4324.96. Users are advised to update their Chrome browsers to this version or later to mitigate the risk. The fix was also implemented in Microsoft Edge Chromium version 88.0.705.50 (NVD).