Microsoft Patch Tuesday, February 2021: the CVEs

Microsoft Patch Tuesday February 2021: the CVEs Microsoft published on 9 February 2021, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Jan 2021, Dec 2020, Nov 2020, Oct 2020, Sep 2020, Aug 2020, Jul 2020, Jun 2020, May 2020, Apr 2020, Mar 2020, Feb 2020. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

1. 6.5CVE-2021-21141EPSS 5.9%2021-02-09

   Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass file extension policy via a crafted HTML page.

2. 6.8CVE-2021-21140EPSS 0.8%2021-02-09

   Uninitialized use in USB in Google Chrome prior to 88.0.4324.96 allowed a local attacker to potentially perform out of bounds memory access via via a USB device.

3. 6.5CVE-2021-21139EPSS 5.1%2021-02-09

   Inappropriate implementation in iframe sandbox in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

4. 6.5CVE-2021-21137EPSS 6.4%2021-02-09

   Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to obtain potentially sensitive information from disk via a crafted HTML page.

5. 6.5CVE-2021-21136EPSS 4.5%2021-02-09

   Insufficient policy enforcement in WebView in Google Chrome on Android prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

6. 6.5CVE-2021-21135EPSS 21%2021-02-09

   Inappropriate implementation in Performance API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

7. 6.5CVE-2021-21134EPSS 5.4%2021-02-09

   Incorrect security UI in Page Info in Google Chrome on iOS prior to 88.0.4324.96 allowed a remote attacker to spoof security UI via a crafted HTML page.

8. 6.5CVE-2021-21133EPSS 3.3%2021-02-09

   Insufficient policy enforcement in Downloads in Google Chrome prior to 88.0.4324.96 allowed an attacker who convinced a user to download files to bypass navigation restrictions via a crafted HTML page.

9. 9.6CVE-2021-21132EPSS 25%2021-02-09

   Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted Chrome Extension.

10. 6.5CVE-2021-21131EPSS 8.2%2021-02-09

    Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.

11. 6.5CVE-2021-21130EPSS 5.9%2021-02-09

    Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.

12. 6.5CVE-2021-21129EPSS 5.9%2021-02-09

    Insufficient policy enforcement in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.

13. 8.8CVE-2021-21128EPSS 7.0%2021-02-09

    Heap buffer overflow in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

14. 8.8CVE-2021-21127EPSS 6.3%2021-02-09

    Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass content security policy via a crafted Chrome Extension.

15. 6.5CVE-2021-21126EPSS 9.4%2021-02-09

    Insufficient policy enforcement in extensions in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass site isolation via a crafted Chrome Extension.

16. 8.1CVE-2021-21125EPSS 8.7%2021-02-09

    Insufficient policy enforcement in File System API in Google Chrome on Windows prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.

17. 9.6CVE-2021-21124EPSS 8.5%2021-02-09

    Potential user after free in Speech Recognizer in Google Chrome on Android prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

18. 6.5CVE-2021-21123EPSS 11%2021-02-09

    Insufficient data validation in File System API in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass filesystem restrictions via a crafted HTML page.

19. 8.8CVE-2021-21122EPSS 7.6%2021-02-09

    Use after free in Blink in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

20. 9.6CVE-2021-21121EPSS 6.7%2021-02-09

    Use after free in Omnibox in Google Chrome on Linux prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

21. 8.8CVE-2021-21120EPSS 7.4%2021-02-09

    Use after free in WebSQL in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

22. 8.8CVE-2021-21119EPSS 7.4%2021-02-09

    Use after free in Media in Google Chrome prior to 88.0.4324.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.

23. 8.8CVE-2021-21118EPSS 18%2021-02-09

    Insufficient data validation in V8 in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.