CVE-2021-42762

BubblewrapLauncher.cpp in WebKitGTK and WPE WebKit before 2.34.1 allows a limited sandbox bypass that allows a sandboxed process to trick host processes into thinking the sandboxed process is not confined by the sandbox, by abusing VFS syscalls that manipulate its filesystem namespace. The impact is limited to host services that create UNIX sockets that WebKit mounts inside its sandbox, and the sandboxed process remains otherwise confined. NOTE: this is similar to CVE-2021-41133.

• http://www.openwall.com/lists/oss-security/2021/10/26/9Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/10/27/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/10/27/2Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/10/27/4Mailing List, Third Party Advisory
• https://bugs.webkit.org/show_bug.cgi?id=231479Exploit, Issue Tracking, Vendor Advisory
• https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4qThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H6MGXCX7P5AHWOQ6IRT477UKT7IS4DAD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5J2LZQTDX53DNSKSGU7TQYCO2HKSTY4/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON5SDVVPVPCAGFPW2GHYATZVZYLPW2L4/
• https://www.debian.org/security/2021/dsa-4995Third Party Advisory
• https://www.debian.org/security/2021/dsa-4996Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/10/26/9Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/10/27/1Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/10/27/2Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/10/27/4Mailing List, Third Party Advisory
• https://bugs.webkit.org/show_bug.cgi?id=231479Exploit, Issue Tracking, Vendor Advisory
• https://github.com/flatpak/flatpak/security/advisories/GHSA-67h7-w3jq-vh4qThird Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H6MGXCX7P5AHWOQ6IRT477UKT7IS4DAD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/M5J2LZQTDX53DNSKSGU7TQYCO2HKSTY4/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ON5SDVVPVPCAGFPW2GHYATZVZYLPW2L4/
• https://www.debian.org/security/2021/dsa-4995Third Party Advisory
• https://www.debian.org/security/2021/dsa-4996Third Party Advisory

Published

Oct 20, 2021

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-42757A buffer overflow [CWE-121] in the TFTP client library of Fo…6.7
• CVE-2021-42758An improper access control vulnerability [CWE-284] in FortiW…8.8
• CVE-2021-42759A violation of secure design principles in Fortinet Meru AP …6.7
• CVE-2021-4276** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in…8.8
• CVE-2021-42760A improper neutralization of special elements used in an sql…8.8
• CVE-2021-42761A condition for session fixation vulnerability [CWE-384] in …9.8
• CVE-2021-42763Couchbase Server before 6.6.3 and 7.x before 7.0.2 stores Se…7.5
• CVE-2021-42764The Proof-of-Stake (PoS) Ethereum consensus protocol through…9.1
• CVE-2021-42765The Proof-of-Stake (PoS) Ethereum consensus protocol through…7.5
• CVE-2021-42766The Proof-of-Stake (PoS) Ethereum consensus protocol through…9.1
• CVE-2021-42767A directory traversal vulnerability in the apoc plugins in N…9.1
• CVE-2021-4277A vulnerability, which was classified as problematic, has be…5.3