PT-2021-2795 · Google+3 · V8+4

Jose Martinez · Published 2021-04-05 · Updated 2025-10-24 · CVE-2021-21224

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 90.0.4430.85

Description The issue is related to a type confusion in V8, allowing a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This could potentially lead to the execution of malicious code. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

Recommendations For versions prior to 90.0.4430.85, update to version 90.0.4430.85 or later to resolve the issue. As a temporary workaround, consider restricting access to potentially vulnerable V8 components until a patch is applied. Avoid using crafted HTML pages that could trigger the type confusion in V8.

Exploit

Fix

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

ALSA-2021_4381

ALSA-2025_16880

ALT-PU-2021-1876

ALT-PU-2021-1972

ALT-PU-2021-2007

ALT-PU-2021-2009

ALT-PU-2021-2141

BDU:2021-02338

CVE-2021-21224

DSA-4906-1

OPENSUSE-SU-2021:0629-1

OPENSUSE-SU-2021:0712-1

OPENSUSE-SU-2021_0629-1

OPENSUSE-SU-2021_0712-1

OPENSUSE-SU-2024:10681-1

OPENSUSE-SU-2024:12948-1

Affected Products

Alt Linux

Astra Linux

Google Chrome

Suse

V8

References · 2353

• 🔥❌ https://github.com/ohnonoyesyes/CVE-2021-21224 · Exploit, Deleted
• 🔥 https://crbug.com/1195777 · Exploit
• https://safe-surf.ru/specialists/bulletins-nkcki/664263 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-21224 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2021-1126SE17 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4906-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-21224 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21224 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-21224 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-21224 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02338 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY · Vendor Advisory
• https://security.gentoo.org/glsa/202104-08 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A · Vendor Advisory