CVE-2021-21206: high-severity vulnerability in Google Chrome
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
Google Chrome had a flaw where it could use memory that was already freed, allowing attackers to corrupt the system's memory through a malicious webpage. This could lead to crashes or potentially allow an attacker to run malicious code.
Use-after-free vulnerability in Blink rendering engine allowing remote code execution via crafted HTML. Attack vector: opening a malicious webpage; impact: heap corruption potentially leading to arbitrary code execution. Fixed in Chrome 89.0.4389.128.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.