CVE-2021-21171: 
vulnerability analysis and mitigation

CVE-2021-21171 is a security vulnerability discovered in Google Chrome on Android prior to version 89.0.4389.72. The vulnerability involves incorrect security UI implementation in TabStrip and Navigation components that allowed remote attackers to spoof the contents of the Omnibox (URL bar) through a crafted HTML page. The issue was reported by Irvan Kurniawan (sourc7) on November 25, 2020 (Chrome Release).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. This indicates that the vulnerability is network exploitable, requires low attack complexity, needs no privileges, requires user interaction, has unchanged scope, and can impact integrity but not confidentiality or availability (NVD).

The vulnerability allows an attacker to spoof the contents of the Omnibox (URL bar) in Google Chrome on Android devices. This could potentially lead to users being deceived about the website they are visiting, enabling phishing attacks and other forms of web-based deception (NVD).

The vulnerability requires user interaction and can be exploited remotely through a crafted HTML page. The attacker needs no special privileges to execute the attack, though they must convince a user to interact with the malicious content (NVD).

The vulnerability was fixed in Google Chrome version 89.0.4389.72. Users should update their Chrome browser to this version or later. The fix has been distributed through various Linux distributions including Debian (89.0.4389.114-1~deb10u1), Fedora (89.0.4389.90), and Gentoo (Debian Advisory, Fedora Update).