CVE-2021-21220

HIGH KEV

Google Chrome <89.0.4389.128 - Heap Corruption

Title source: llm

Description

Insufficient validation of untrusted input in V8 in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Exploits (4)

nomisec WORKING POC
by JacobTaylor3 · poc
https://github.com/JacobTaylor3/CVE-2021-21220
nomisec WORKING POC
by AmesianX · poc
https://github.com/AmesianX/CVE-2021-21220
metasploit WORKING POC MANUAL
by Bruno Keith (bkth_), Niklas Baumstark (_niklasb), Rajvardhan Agarwal (r4j0x00), Grant Willcox (tekwizz123) · rubypoclinux
https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/browser/chrome_cve_2021_21220_v8_insufficient_validation.rb

Scores

CVSS v3 8.8
EPSS 0.9260
EPSS Percentile 99.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CISA KEV 2021-11-03
VulnCheck KEV 2021-06-08
InTheWild.io 2021-04-07
ENISA EUVD EUVD-2021-8611
CWE
CWE-787
Status published
Products (4)
fedoraproject/fedora 32
fedoraproject/fedora 33
fedoraproject/fedora 34
google/chrome < 89.0.4389.128
Published Apr 26, 2021
KEV Added Nov 03, 2021
Tracked Since Feb 18, 2026