CVE-2021-21173: 
vulnerability analysis and mitigation

Side-channel information leakage in Network Internals in Google Chrome prior to version 89.0.4389.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability was discovered by Tom Van Goethem from imec-DistriNet, KU Leuven and was assigned CVE-2021-21173 (Chrome Release).

The vulnerability is classified as a medium severity issue with a CVSS v3.1 base score of 6.5. The attack vector is network-based, with low attack complexity, requiring no privileges but needing user interaction. The scope is unchanged, with high confidentiality impact but no impact on integrity or availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) (NVD).

The vulnerability could allow an attacker to leak cross-origin data through a side-channel attack when a user visits a specially crafted HTML page. This could potentially lead to unauthorized access to sensitive information across different origins (Debian Advisory).

The vulnerability requires user interaction to visit a malicious webpage. The attack can be executed remotely, and the complexity of exploitation is considered low, making it relatively straightforward for attackers to exploit if unpatched (NVD).

The vulnerability was fixed in Google Chrome version 89.0.4389.72. Users and administrators should upgrade to this version or later to mitigate the risk. The fix has been backported to various Linux distributions including Debian, Fedora, and Gentoo (Gentoo Advisory, Debian Advisory).