CVE-2021-21213
📋 TL;DR
This is a use-after-free vulnerability in Chrome's WebMIDI implementation that allows remote attackers to potentially exploit heap corruption. Attackers can trigger this vulnerability by tricking users into visiting a malicious HTML page. All Chrome users prior to version 90.0.4430.72 are affected.
💻 Affected Systems
- Google Chrome
- Chromium-based browsers
📦 What is this software?
Chrome by Google
Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...
Learn more about Chrome →Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, data theft, or ransomware deployment.
Likely Case
Browser crash (denial of service) or limited memory corruption leading to information disclosure.
If Mitigated
No impact if Chrome is updated to patched version or if WebMIDI is disabled.
🎯 Exploit Status
Exploitation requires heap manipulation techniques but is facilitated by the use-after-free primitive. No public exploit code has been released.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 90.0.4430.72 and later
Vendor Advisory: https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html
Restart Required: Yes
Instructions:
1. Open Chrome and click the three-dot menu. 2. Go to Help > About Google Chrome. 3. Chrome will automatically check for updates and install version 90.0.4430.72 or later. 4. Click 'Relaunch' to restart Chrome with the update.
🔧 Temporary Workarounds
Disable WebMIDI API
allDisables the WebMIDI API which contains the vulnerable component
chrome://flags/#enable-web-midi-api
Set to 'Disabled'
Use Chrome Enterprise policies
windowsDisable WebMIDI via group policy for enterprise deployments
Set 'DefaultWebMIDISysExPermission' to 2 (Block)
🧯 If You Can't Patch
- Disable WebMIDI API via chrome://flags as temporary mitigation
- Use browser isolation technologies or sandboxing to contain potential exploitation
🔍 How to Verify
Check if Vulnerable:
Check Chrome version: if below 90.0.4430.72, you are vulnerableCheck Version:
chrome://version/ or 'google-chrome --version' on LinuxVerify Fix Applied:
Confirm Chrome version is 90.0.4430.72 or higher📡 Detection & Monitoring
Log Indicators:
- Chrome crash reports with WebMIDI-related stack traces
- Unexpected Chrome process termination
Network Indicators:
- Requests to suspicious domains with WebMIDI-related parameters
- Unusual WebSocket or MIDI protocol traffic
SIEM Query:
source="chrome_crash_reports" AND (process="chrome" OR process="chromium") AND message="*WebMIDI*" OR message="*use-after-free*"🔗 References
- https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html
- https://crbug.com/1161806
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/
- https://security.gentoo.org/glsa/202104-08
- https://www.debian.org/security/2021/dsa-4906
- https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_14.html
- https://crbug.com/1161806
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/
- https://security.gentoo.org/glsa/202104-08
- https://www.debian.org/security/2021/dsa-4906
