CVE-2021-21220
HIGH KEVGoogle Chrome <89.0.4389.128 - Heap Corruption
Title source: llmDescription
Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Exploits (4)
metasploit
WORKING POC
MANUAL
by Bruno Keith (bkth_), Niklas Baumstark (_niklasb), Rajvardhan Agarwal (r4j0x00), Grant Willcox (tekwizz123) · rubypoclinux
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/chrome_cve_2021_21220_v8_insufficient_validation.rb
Scores
CVSS v3
8.8
EPSS
0.9260
EPSS Percentile
99.7%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Details
CISA KEV
2021-11-03
VulnCheck KEV
2021-06-08
InTheWild.io
2021-04-07
ENISA EUVD
EUVD-2021-8611
CWE
CWE-787
Status
published
Products (4)
fedoraproject/fedora
32
fedoraproject/fedora
33
fedoraproject/fedora
34
google/chrome
< 89.0.4389.128
Published
Apr 26, 2021
KEV Added
Nov 03, 2021
Tracked Since
Feb 18, 2026