Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2021-21193

Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafte

Affects Google Chrome before 89.0.4389.90, a use-after-free in Blink. Fixed in Chrome 89.0.4389.90; Debian's package 89.0.4389.114-1~deb10u1 includes the fix.

Published
Last modified
published
Listed in CISA KEV
Actively exploited
Fix
Fixed in 89.0.4389.90
None on Exploit-DB, Metasploit or GitHub

Summary

Google Chrome web browser is affected by this vulnerability, which is in its Blink rendering engine. A remote attacker could potentially exploit it by tricking a user into opening a specially crafted web page, which could corrupt memory and may lead to compromise of the browser.

Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.

Read the original description

Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Timeline

  1. CVE published
  2. Added to CISA KEV

    CISA has evidence of exploitation in the wild

  3. CISA remediation deadline

    Due date for US federal agencies to patch

  4. Record last updated

Affected versions

  • Google Chrome

    From unspecified · fixed in 89.0.4389.90

References 5

chromereleases.googleblog.com

crbug.com

debian.org

lists.fedoraproject.org

security.gentoo.org

FAQ

Questions about CVE-2021-21193

What should I do about it?

Upgrade Google Chrome to 89.0.4389.90 or later. On Debian, install 89.0.4389.114-1~deb10u1 or later.Source: lists.debian.org

Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2021-11-03, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data