CVE-2021-21193: high-severity vulnerability in Google Chrome
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
A memory error in Google Chrome's browser engine allows attackers to crash your browser or potentially run malicious code by visiting a specially designed webpage. This happens because the browser tries to use data that has already been freed from memory.
Use-after-free vulnerability in Blink rendering engine (CWE-416) allows remote code execution or heap corruption via malicious HTML. Requires user interaction (visiting a crafted webpage); affected versions prior to Chrome 89.0.4389.90. Attack vector is network-based with low attack complexity.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.