Vulnerability · Published Feb 26, 2022 · Assigned by mitre
CVE-2021-46702
Medium 5.5
In plain English
A medium-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Official description
Tor Browser 9.0.7 on Windows 10 build 10586 is vulnerable to information disclosure. This could allow local attackers to bypass the intended anonymity feature and obtain information regarding the onion services visited by a local user. This can be accomplished by analyzing RAM memory even several hours after the local user used the product. This occurs because the product doesn't properly free memory.
Affected products (as reported)
References
- https://www.sciencedirect.com/science/article/pii/S0167404821001358 x_refsource_MISC