CVE-2021-4102

CVE-2021-4102 is a use-after-free (CWE-416) in the V8 JavaScript engine of Google Chrome, fixed in Chrome 96.0.4664.110. It is triggered remotely when a user is lured to a crafted HTML page (per the CVSS vector, network attack vector with required user interaction), allowing the attacker to trigger heap corruption in the browser process. Successful exploitation could give the attacker control over corrupted heap memory with high confidentiality, integrity, and availability impact, though no public proof-of-concept is known. Anyone running Google Chrome prior to 96.0.4664.110 is affected, and because CISA frames the flaw in Chromium's V8, Chromium-based browsers that had not yet merged the equivalent fix were also potentially exposed. The bug is a confirmed zero-day: CISA added it to the Known Exploited Vulnerabilities catalog on 2021-12-15, and press coverage counts it as the 17th Chrome zero-day fixed in 2021.

What to do: Update Google Chrome to 96.0.4664.110 or later on all systems and restart the browser to load the patched engine; this satisfies CISA's required action to apply updates per vendor instructions. Inventory enterprise endpoints to confirm no clients remain below 96.0.4664.110, and users of Chromium-derived browsers should apply the corresponding vendor update as soon as it is released. Until patched, exercise caution with untrusted web links, as exploitation requires visiting attacker-controlled HTML content.