CVE-2021-21232
📋 TL;DR
This is a use-after-free vulnerability in Chrome's Dev Tools that allows remote attackers to potentially exploit heap corruption via a crafted HTML page. Attackers could execute arbitrary code or cause browser crashes. All users of affected Chrome versions are vulnerable when visiting malicious websites.
💻 Affected Systems
- Google Chrome
📦 What is this software?
Chrome by Google
Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...
Learn more about Chrome →Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, data theft, or malware installation on the victim's machine.
Likely Case
Browser crash (denial of service) or limited code execution within the browser sandbox, potentially leading to session hijacking or credential theft.
If Mitigated
No impact if Chrome is fully patched or if the vulnerability is blocked by security controls.
🎯 Exploit Status
Exploitation requires user interaction (visiting malicious page) and Dev Tools functionality. No public exploit code is known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 90.0.4430.93 and later
Vendor Advisory: https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html
Restart Required: Yes
Instructions:
1. Open Chrome. 2. Click the three-dot menu → Help → About Google Chrome. 3. Chrome will automatically check for and install updates. 4. Click 'Relaunch' to restart Chrome with the update.
🔧 Temporary Workarounds
Disable Dev Tools
allPrevent exploitation by disabling Chrome Dev Tools via enterprise policy or registry settings.
Windows Registry: HKEY_LOCAL_MACHINE\Software\Policies\Google\Chrome\DeveloperToolsDisabled = 1
macOS/Linux: Use Chrome Enterprise policies to set DeveloperToolsDisabled to true
Use Chrome Sandbox
allEnsure Chrome sandbox is enabled to limit impact if exploitation occurs.
Verify sandbox status: chrome://sandbox/
🧯 If You Can't Patch
- Block access to untrusted websites using web filtering or firewall rules.
- Implement application allowlisting to prevent unauthorized code execution.
🔍 How to Verify
Check if Vulnerable:
Check Chrome version: If version is below 90.0.4430.93, the system is vulnerable.Check Version:
chrome://version/ or 'google-chrome --version' on command lineVerify Fix Applied:
Confirm Chrome version is 90.0.4430.93 or higher after update.📡 Detection & Monitoring
Log Indicators:
- Chrome crash reports in system logs
- Unexpected Dev Tools activity in Chrome logs
Network Indicators:
- Requests to known malicious domains hosting exploit code
- Unusual outbound connections from Chrome process
SIEM Query:
source="chrome" AND (event_type="crash" OR message="*devtools*" OR message="*use-after-free*")🔗 References
- https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html
- https://crbug.com/1175058
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/
- https://security.gentoo.org/glsa/202104-08
- https://www.debian.org/security/2021/dsa-4911
- https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_26.html
- https://crbug.com/1175058
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/
- https://security.gentoo.org/glsa/202104-08
- https://www.debian.org/security/2021/dsa-4911
