Actively exploited · Published Mar 16, 2021 · Assigned by Chrome

CVE-2021-21193

High 8.8 Exploited

In plain English

A high-severity use-after-free in Chrome from Google. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 10.0% (higher than 96% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.8High

Exploit odds (30 days)10.0%top 4.4% of all CVEs

Exploited in the wildYesCISA KEV since Nov 3, 2021

Attack tooling1Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Nov 17, 2021.

Official description

Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Alpine:v3.20	chromium	89.0.4389.90-r0	ALPINE-CVE-2021-21193
Alpine:v3.21	chromium	89.0.4389.90-r0	ALPINE-CVE-2021-21193
Alpine:v3.22	chromium	89.0.4389.90-r0	ALPINE-CVE-2021-21193
Alpine:v3.23	chromium	89.0.4389.90-r0	ALPINE-CVE-2021-21193
Alpine:v3.24	chromium	89.0.4389.90-r0	ALPINE-CVE-2021-21193
Alpine:v3.20	qt5-qtwebengine	5.15.3_git20200401-r0	ALPINE-CVE-2021-21193
Alpine:v3.21	qt5-qtwebengine	5.15.3_git20200401-r0	ALPINE-CVE-2021-21193
Alpine:v3.22	qt5-qtwebengine	5.15.3_git20200401-r0	ALPINE-CVE-2021-21193
Alpine:v3.23	qt5-qtwebengine	5.15.3_git20200401-r0	ALPINE-CVE-2021-21193
Debian:12	chromium	89.0.4389.90-1	DEBIAN-CVE-2021-21193
Debian:13	chromium	89.0.4389.90-1	DEBIAN-CVE-2021-21193
Debian:14	chromium	89.0.4389.90-1	DEBIAN-CVE-2021-21193

Affected products (as reported)

Vendor	Product	Versions
Google	Chrome	unspecified – before 89.0.4389.90

Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References

https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_12.html x_refsource_MISC
https://crbug.com/1186287 x_refsource_MISC
DSA-4886 vendor-advisory, x_refsource_DEBIAN
FEDORA-2021-141d8640ce vendor-advisory, x_refsource_FEDORA
GLSA-202104-08 vendor-advisory, x_refsource_GENTOO
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21193 government-resource