PT-2021-2391 · Google+3 · Google Chrome+3

Published 2021-03-09 · Updated 2025-10-24 · CVE-2021-21193

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 89.0.4389.90

Description: The issue is related to a use-after-free vulnerability in the Blink component of Google Chrome, which can be exploited by a remote attacker via a crafted HTML page, potentially leading to heap corruption. Google is aware of reports that an exploit for this issue exists in the wild. The vulnerability is caused by accessing already freed memory in the JavaScript engine Blink.

Recommendations: For Google Chrome versions prior to 89.0.4389.90, update to version 89.0.4389.90 or the latest available version to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable web pages until the update is applied.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2021-1486

ALT-PU-2021-1559

ALT-PU-2021-1668

ALT-PU-2021-1751

ALT-PU-2021-2141

BDU:2021-01633

CVE-2021-21193

DSA-4886-1

MGASA-2021-0142

OPENSUSE-SU-2021:0436-1

OPENSUSE-SU-2021:0446-1

OPENSUSE-SU-2021:0592-1

OPENSUSE-SU-2021_0436-1

OPENSUSE-SU-2021_0592-1

OPENSUSE-SU-2024:10681-1

OPENSUSE-SU-2024:12948-1

Affected Products

Alt Linux

Astra Linux

Google Chrome

Suse

References · 2368

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/chrome_cve_2021_21220_v8_insufficient_validation.rb · Exploit
• 🔥 https://github.com/xmzyshypnc/CVE-2021-30551 · Exploit
• 🔥 https://github.com/security-dbg/CVE-2021-21220 · Exploit
• 🔥❌ https://github.com/ohnonoyesyes/CVE-2021-21224 · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2021-21193 · Security Note
• https://ubuntu.com/security/CVE-2021-21193 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21193 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10681-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20210611SE16 · Vendor Advisory
• https://security.gentoo.org/glsa/202104-08 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4886-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0592-1 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/662880 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N52OWF4BAP3JNK2QYGU3Q6QUVDZDCIMQ · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory