cbcvebase.
CVE-2021-21110
published 2021-01-08

CVE-2021-21110: Use after free in safe browsing in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML…

PriorityP353critical9.6CVSS 3.1
AVNACLPRNUIRSCCHIHAH
EPSS
3.09%
86.4th percentile
Use after free in safe browsing in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

Affected

11 ranges
VendorProductVersion rangeFixed in
chromiumchromium>= 0 < 87.0.4280.141-0.187.0.4280.141-0.1
chromiumchromium>= 0 < 87.0.4280.141-0.187.0.4280.141-0.1
chromiumchromium>= 0 < 87.0.4280.141-0.187.0.4280.141-0.1
chromiumchromium>= 0 < 87.0.4280.141-0.187.0.4280.141-0.1
debianchromium< chromium 87.0.4280.141-0.1 (bookworm)chromium 87.0.4280.141-0.1 (bookworm)
debiandebian_linux——
fedoraprojectfedora——
fedoraprojectfedora——
googlechrome< 87.0.4280.14187.0.4280.141
googlechrome>= unspecified < 87.0.4280.14187.0.4280.141
googlechrome_chrome——

Detection & IOCsextracted from sources · hover to see the quote

  • →Vulnerability is a use-after-free in the Safe Browsing component of Google Chrome prior to version 87.0.4280.141, exploitable via a crafted HTML page to potentially achieve sandbox escape ↗
  • →Target Chrome versions below 87.0.4280.141; patch was introduced in 87.0.4280.141-0.1 on Debian-based systems ↗
  • →CVE-2021-21110 was reported anonymously on 2020-11-24 and is rated High severity; correlate with Chrome Safe Browsing component crashes or anomalous renderer-to-browser process escalation around that timeframe ↗
  • ·Exploitation requires delivery of a crafted HTML page to the victim; attack surface is remote but requires user interaction (browsing to malicious content) ↗
  • ·Debian scopes this as 'local' despite the NVD remote-attacker classification; detection posture may differ depending on environment context ↗

CVSS provenance

nvdv3.19.6CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv9.6CRITICAL
vendor_debian9.6CRITICAL
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.