CVE-2021-21166: Google Chromium Race Condition Vulnerability

High severity · published Mar 9, 2021

CVE-2021-21166

Google Chromium Race Condition Vulnerability

In wildKEV

8.8

CVSS

24%

EPSS

Yes

On KEV

Description

Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)24.0% · higher than 98% of CVEs

Exploited in the wildYes

CISA KEVListed Nov 3, 2021

Federal remediation dueNov 17, 2021

Ransomware campaign useNot known

Affected products

Which versions

Chrome · Google

before 89.0.4389.72 · source: vendor, NVD, KEV

Debian Linux · Debian

10.0 · source: NVD

Fedora · Fedoraproject

32; 33; 34 · source: NVD

Affected product

Chrome

Google

All Chrome CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2021-21166

CVE.org

https://www.cve.org/CVERecord?id=CVE-2021-21166

CISA KEV catalogue

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

x_refsource_MISC

https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop.html

x_refsource_MISC

https://crbug.com/1177465

vendor-advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FE5SIKEVYTMDCC5OSXGOM2KRPYLHYMQX/

vendor-advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BBT54RKAE5XLMWSHLVUKJ7T2XHHYMXLH/

vendor-advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LCIDZ77XUDMB2EBPPWCQXPEIJERDNSNT/

vendor-advisory

https://www.debian.org/security/2021/dsa-4886