⚠ Actively exploited

Added to CISA KEV on 2021-11-03. Federal agencies required to patch by 2021-11-17. Required action: Apply updates per vendor instructions..

CVE-2021-21220 — Out-of-bounds Write in Google Chrome

CWE-787 — Out-of-bounds Write CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer CWE-20 — Improper Input Validation CWE-122 — Heap-based Buffer Overflow30 documents15 sources

Severity

8.8HIGHNVD

EPSS

92.6%

top 0.26%

CISA KEV

KEV

Added 2021-11-03

Due 2021-11-17

Exploit

Exploited in wild

Active exploitation observed

Affected products

Google Chrome Chromium Debian Chromium +3 more

Timeline

PublishedApr 26

KEV addedNov 3

KEV dueNov 17

Latest updateOct 5

CISA Required Action: Apply updates per vendor instructions.

Description

Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages6 packages

▶CVEListV5google/chromeunspecified — 89.0.4389.128

▶NVDgoogle/chrome< 89.0.4389.128

▶googlegoogle/chrome_chrome

▶debiandebian/chromium< chromium 90.0.4430.72-1 (bookworm)

▶Debianchromium/chromium< 90.0.4430.72-1+3

Also affects: Fedora 32, 33, 34

🔴Vulnerability Details

GHSA

GHSA-5cw9-vvr5-jcwf: Insufficient validation of untrusted input in V8 in Google Chrome prior to 89↗2022-05-24

▶

OSV

CVE-2021-21220: Insufficient validation of untrusted input in V8 in Google Chrome prior to 89↗2021-04-26

▶

VulnCheck

Google Chromium V8 Improper Input Validation Vulnerability↗2021

▶

💥Exploits & PoCs

Metasploit

Google Chrome versions before 89.0.4389.128 V8 XOR Typer Out-Of-Bounds Access RCE↗

▶

📋Vendor Advisories

CISA

Google Chromium V8 Improper Input Validation Vulnerability↗2021-11-03

▶

Chrome

Stable Channel Update for Desktop: CVE-2021-21206↗2021-04-13

▶

Microsoft

Chromium: CVE-2021-21220 Insufficient validation of untrusted input in V8 for x86_64↗2021-04-13

▶

Debian

CVE-2021-21220: chromium - Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0....↗2021

▶