CVE-2021-21115
📋 TL;DR
This is a use-after-free vulnerability in Chrome's safe browsing component that allows a compromised renderer process to escape the browser sandbox. Attackers could execute arbitrary code with elevated privileges by tricking users into visiting malicious websites. All Chrome users on versions before 87.0.4280.141 are affected.
💻 Affected Systems
- Google Chrome
📦 What is this software?
Chrome by Google
Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...
Learn more about Chrome →Fedora by Fedoraproject
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise where attacker gains full control of the victim's machine, installs malware, steals credentials, and accesses sensitive data.
Likely Case
Attacker escapes Chrome sandbox to execute arbitrary code with user-level privileges, potentially installing ransomware, keyloggers, or joining botnets.
If Mitigated
With updated Chrome, no impact as the vulnerability is patched. With proper network controls, malicious sites may be blocked before exploitation.
🎯 Exploit Status
Requires chaining with another vulnerability to compromise renderer first, then this vulnerability enables sandbox escape.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 87.0.4280.141
Vendor Advisory: https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop.html
Restart Required: Yes
Instructions:
1. Open Chrome 2. Click menu (three dots) → Help → About Google Chrome 3. Chrome will automatically check for and install updates 4. Click 'Relaunch' to restart Chrome
🔧 Temporary Workarounds
Disable JavaScript
allTemporarily disable JavaScript to prevent exploitation, but breaks most websites
chrome://settings/content/javascript → Block
Use alternative browser
allSwitch to updated alternative browser until Chrome is patched
🧯 If You Can't Patch
- Implement network filtering to block known malicious domains
- Restrict user privileges and implement application whitelisting
🔍 How to Verify
Check if Vulnerable:
Check Chrome version: chrome://version and verify it's below 87.0.4280.141Check Version:
chrome://versionVerify Fix Applied:
Confirm Chrome version is 87.0.4280.141 or higher📡 Detection & Monitoring
Log Indicators:
- Chrome crash reports with safe browsing component
- Unusual process creation from Chrome sandbox
Network Indicators:
- Connections to known malicious domains triggering safe browsing
- Unusual outbound traffic from Chrome processes
SIEM Query:
process_name:chrome.exe AND (parent_process:chrome.exe OR command_line:*--type=renderer*) AND event_type:process_creation🔗 References
- https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop.html
- https://crbug.com/1157814
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVUWIJKZTZTG6G475OR6PP4WPQBVM6PS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z6P6AVVFP7B2M4H7TJQBASRZIBLOTUFN/
- https://security.gentoo.org/glsa/202101-05
- https://www.debian.org/security/2021/dsa-4832
- https://chromereleases.googleblog.com/2021/01/stable-channel-update-for-desktop.html
- https://crbug.com/1157814
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VVUWIJKZTZTG6G475OR6PP4WPQBVM6PS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z6P6AVVFP7B2M4H7TJQBASRZIBLOTUFN/
- https://security.gentoo.org/glsa/202101-05
- https://www.debian.org/security/2021/dsa-4832
