CVE-2021-21194
📋 TL;DR
This vulnerability is a use-after-free memory corruption flaw in Google Chrome's screen sharing feature. It allows remote attackers to potentially execute arbitrary code or cause denial of service by tricking users into visiting a malicious webpage. All users running vulnerable versions of Chrome are affected.
💻 Affected Systems
- Google Chrome
📦 What is this software?
Chrome by Google
Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...
Learn more about Chrome →Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, data theft, or ransomware deployment.
Likely Case
Browser crash/denial of service or limited code execution within browser sandbox.
If Mitigated
No impact if Chrome is updated or screen sharing is disabled.
🎯 Exploit Status
Requires user to visit malicious page and interact with screen sharing prompt.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 89.0.4389.114
Vendor Advisory: https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_30.html
Restart Required: Yes
Instructions:
1. Open Chrome. 2. Click menu (three dots) → Help → About Google Chrome. 3. Chrome will check for and install updates automatically. 4. Click Relaunch to restart Chrome.
🔧 Temporary Workarounds
Disable screen sharing
allPrevent exploitation by disabling screen sharing permissions.
chrome://settings/content/screenShare
Use browser extensions
allInstall script blockers like NoScript or uBlock Origin to block malicious scripts.
🧯 If You Can't Patch
- Restrict access to untrusted websites using web filtering.
- Implement application whitelisting to prevent unauthorized Chrome execution.
🔍 How to Verify
Check if Vulnerable:
Check Chrome version via chrome://settings/help or 'chrome://version'.Check Version:
google-chrome --version (Linux) or check via chrome://versionVerify Fix Applied:
Confirm Chrome version is 89.0.4389.114 or later.📡 Detection & Monitoring
Log Indicators:
- Chrome crash logs with memory corruption errors
- Unexpected screen sharing permission requests
Network Indicators:
- HTTP requests to known malicious domains hosting exploit code
SIEM Query:
source="chrome" AND (event="crash" OR event="permission_request") AND screen_share=true🔗 References
- https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_30.html
- https://crbug.com/1181228
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/
- https://security.gentoo.org/glsa/202104-08
- https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_30.html
- https://crbug.com/1181228
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/
- https://security.gentoo.org/glsa/202104-08
