CVE-2021-21206

Google Chrome and Chromium versions prior to 89.0.4389.128 contain a use-after-free flaw (CWE-416) in the Blink rendering engine. A remote attacker can trigger it by luring a user into opening a crafted HTML page, requiring no privileges and only user interaction, which corrupts browser process memory (heap corruption) and can potentially allow arbitrary code execution within the browser. All users of Chrome or Chromium builds older than 89.0.4389.128 are affected, including the Chromium package shipped by Fedora. Google fixed the bug as an actively exploited zero-day in the same release as CVE-2021-21205, and CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03; EPSS estimates a 9.3% probability of exploitation within 30 days (95th percentile).

What to do: Upgrade Google Chrome/Chromium to 89.0.4389.128 or later (verify via chrome://settings/help) and apply Fedora's updated chromium package, then restart the browser so the fix takes effect. Because the flaw is listed in CISA's KEV catalog and was exploited in the wild, prioritize patching for internet-exposed and high-risk users; no public PoC is known, but treat in-the-wild exploitation as confirmed.