{"vulnerability": "CVE-2021-21191", "sightings": [{"uuid": "79c87bd3-beaf-49b1-968f-2d39638d21ea", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21191", "type": "seen", "source": "MISP/b68115dc-e2d1-4996-8966-85cedf58e561", "content": "", "creation_timestamp": "2024-11-14T06:08:48.000000Z"}, {"uuid": "b8e04819-5ef6-458d-8703-6a244926724f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21191", "type": "seen", "source": "https://t.me/cibsecurity/24954", "content": "\u203c CVE-2021-21191 \u203c\n\nUse after free in WebRTC in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-03-16T17:30:07.000000Z"}, {"uuid": "4155084f-6978-4b37-89dd-03bd51f3b250", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21191", "type": "seen", "source": "https://t.me/hacking_Attack/1241", "content": "Black Hat Ethical Hacking\nGoogle Warns Mac, Windows Users of Chrome Zero-Day Flaw\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Google Warns Mac, Windows Users of Chrome Zero-Day FlawPost Views: 163 \nstyle=\"display:block\"\n data-ad-client=\"ca-pub-6620833063853657\"\n data-ad-slot=\"8337846400\"\n data-ad-format=\"auto\"\n data-full-width-responsive=\"true\"> \nReading Time: 1 Minute\nThe use-after-free vulnerability is the third Google Chrome zero-day flaw to be disclosed in three months.\nGoogle is hurrying out a fix for a vulnerability in its Chrome browser that\u2019s under active attack \u2013 its third zero-day flaw so far this year. If exploited, the flaw could allow remote code-execution and denial-of-service attacks on affected systems.\n\nThe vulnerability exists in Blink, the browser engine for Chrome\u00a0developed as part of the Chromium project. Browser engines convert HTML documents and other web page resources into the visual representations viewable to end users.\n\n\u201cThe Stable channel has been updated to 89.0.4389.90 for Windows, Mac and Linux which will roll out over the coming days/weeks,\u201d according to Google\u2019s Friday security update.\n\nThe flaw (CVE-2021-21193) ranks 8.8 out of 10 on the CVSS vulnerability-rating scale, making it high-severity. It\u2019s a use-after-free vulnerability, which relates to incorrect use of dynamic memory during program operation. If after freeing a memory location, a program does not clear the pointer to that memory, an attacker can use the error to hack the program, according to a description of the vulnerability.\nSee Also: Critical Security Hole Can Knock Smart Meters Offline Use-After-Free Zero-Day FlawAccording to an IBM X-Force vulnerability report, the flaw could allow a remote attacker to execute arbitrary code on the system.\n\n\u201cBy persuading a victim to visit a specially crafted website, a remote attacker could exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition on the system,\u201d according to the report.\n\nFurther details are scant because \u201caccess to bug details and links may be kept restricted until a majority of users are updated with a fix,\u201d according to Google. The bug was credited to an anonymous reporter.\n\nGoogle also did not provide further specifics on the exploits other than to say it \u201cis aware of reports that an exploit for CVE-2021-21193 exists in the wild.\u201d\n\nThreatpost has reached out to Google for further comment.\nSee Also: Offensive Security Tool: Skipfish Other Google Chrome Security FlawsBeyond the zero-day flaw, Google issued four other security fixes on Friday.\n\nThese included another high-severity use-after-free flaw (CVE-2021-21191), which exists in WebRTC. WebRTC, which stands for web real-time communications, is an open-source project that gives web browsers and mobile applications interactive communications capabilities (such as voice, video and chat). The flaw was reported by someone who goes under the alias \u201craven\u201d (@raid_akame on Twitter).\n\nAnother high-severity flaw is a heap-buffer overflow error (CVE-2021-21192) that stems from Chrome tab groups. The flaw was reported by Abdulrahman Alqabandi with Microsoft Browser Vulnerability Research. See Also: Hacking Stories: Albert Gonzalez & the \u2018Get Rich or Die Trying\u2019 Crew who stole 130 million credit-card numbersThird Zero-Day Chrome Security Flaw This YearThe use-after-free flaw is the third zero-day flaw to plague Google\u2019s Chrome browser in the past three months \u2014 and the second this month alone. Earlier in March, Google said it fixed a high-severity zero-day vulnerability in its Chrome browser, which stems from the audio component of the browser.\n[...]", "creation_timestamp": "2026-09-01T20:02:50.765013Z"}, {"uuid": "4ead8e42-dcea-4b1c-945b-808cd9ccc6a0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-21191", "type": "seen", "source": "https://t.me/hacking_Attack/1241", "content": "Black Hat Ethical Hacking\nGoogle Warns Mac, Windows Users of Chrome Zero-Day Flaw\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Google Warns Mac, Windows Users of Chrome Zero-Day FlawPost Views: 163 \nstyle=\"display:block\"\n data-ad-client=\"ca-pub-6620833063853657\"\n data-ad-slot=\"8337846400\"\n data-ad-format=\"auto\"\n data-full-width-responsive=\"true\"> \nReading Time: 1 Minute\nThe use-after-free vulnerability is the third Google Chrome zero-day flaw to be disclosed in three months.\nGoogle is hurrying out a fix for a vulnerability in its Chrome browser that\u2019s under active attack \u2013 its third zero-day flaw so far this year. If exploited, the flaw could allow remote code-execution and denial-of-service attacks on affected systems.\n\nThe vulnerability exists in Blink, the browser engine for Chrome\u00a0developed as part of the Chromium project. Browser engines convert HTML documents and other web page resources into the visual representations viewable to end users.\n\n\u201cThe Stable channel has been updated to 89.0.4389.90 for Windows, Mac and Linux which will roll out over the coming days/weeks,\u201d according to Google\u2019s Friday security update.\n\nThe flaw (CVE-2021-21193) ranks 8.8 out of 10 on the CVSS vulnerability-rating scale, making it high-severity. It\u2019s a use-after-free vulnerability, which relates to incorrect use of dynamic memory during program operation. If after freeing a memory location, a program does not clear the pointer to that memory, an attacker can use the error to hack the program, according to a description of the vulnerability.\nSee Also: Critical Security Hole Can Knock Smart Meters Offline Use-After-Free Zero-Day FlawAccording to an IBM X-Force vulnerability report, the flaw could allow a remote attacker to execute arbitrary code on the system.\n\n\u201cBy persuading a victim to visit a specially crafted website, a remote attacker could exploit this vulnerability to execute arbitrary code or cause a denial-of-service condition on the system,\u201d according to the report.\n\nFurther details are scant because \u201caccess to bug details and links may be kept restricted until a majority of users are updated with a fix,\u201d according to Google. The bug was credited to an anonymous reporter.\n\nGoogle also did not provide further specifics on the exploits other than to say it \u201cis aware of reports that an exploit for CVE-2021-21193 exists in the wild.\u201d\n\nThreatpost has reached out to Google for further comment.\nSee Also: Offensive Security Tool: Skipfish Other Google Chrome Security FlawsBeyond the zero-day flaw, Google issued four other security fixes on Friday.\n\nThese included another high-severity use-after-free flaw (CVE-2021-21191), which exists in WebRTC. WebRTC, which stands for web real-time communications, is an open-source project that gives web browsers and mobile applications interactive communications capabilities (such as voice, video and chat). The flaw was reported by someone who goes under the alias \u201craven\u201d (@raid_akame on Twitter).\n\nAnother high-severity flaw is a heap-buffer overflow error (CVE-2021-21192) that stems from Chrome tab groups. The flaw was reported by Abdulrahman Alqabandi with Microsoft Browser Vulnerability Research. See Also: Hacking Stories: Albert Gonzalez & the \u2018Get Rich or Die Trying\u2019 Crew who stole 130 million credit-card numbersThird Zero-Day Chrome Security Flaw This YearThe use-after-free flaw is the third zero-day flaw to plague Google\u2019s Chrome browser in the past three months \u2014 and the second this month alone. Earlier in March, Google said it fixed a high-severity zero-day vulnerability in its Chrome browser, which stems from the audio component of the browser.\n[...]", "creation_timestamp": "2026-09-02T01:03:26.475316Z"}]}