CVE-2021-4102: high-severity vulnerability in Google Chrome
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
Google Chrome had a flaw where freed memory could still be accessed, allowing attackers to crash the browser or potentially run malicious code through a specially crafted webpage.
Use-after-free vulnerability in V8 engine allows remote attacker to trigger heap corruption via malicious HTML. Exploitation requires user to visit crafted page; successful exploitation can lead to arbitrary code execution or denial of service.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.