Google fixes 15th and 16th Chrome zero

CVE-2021-21148 is a heap buffer overflow (out-of-bounds write, CWE-787) in the V8 JavaScript engine used by Google Chrome and Chromium. A remote attacker triggers it by getting a user to open a crafted HTML page, so user interaction is required, but no privileges or special access are needed. Successful exploitation corrupts the heap and can allow the attacker to run code within the browser, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.8). All Chrome/Chromium builds prior to 88.0.4324.150 are affected, including the chromium packages shipped in Fedora and Debian. Google patched the flaw in an emergency update for what headlines described as a Chrome zero-day, and its inclusion in the CISA Known Exploited Vulnerabilities catalog (added 2021-11-03) confirms exploitation in the wild, despite no public PoC; EPSS estimates a 20% probability of exploitation over the next 30 days (97th percentile).

Do: Upgrade Google Chrome/Chromium to 88.0.4324.150 or later on all endpoints, and install the updated chromium packages from Fedora and Debian. Verify fleet-wide browser versions, since a single user opening a malicious page is enough for compromise, and confirm auto-update is enabled on managed browsers.

Google Chromium contains a race condition (CWE-362) that can lead to heap corruption (CWE-122) when the browser processes a crafted HTML page, meaning an attacker can trigger the flaw simply by getting a user to visit an attacker-controlled or malicious webpage. Successful exploitation of the heap corruption could crash the browser and potentially allow the attacker to execute code within the affected browser process. Because the vulnerable code is in the Chromium engine itself, all Chromium-based browsers are potentially affected, including Google Chrome, Microsoft Edge, Opera, and other derived browsers, across desktop and mobile fleets. CISA added CVE-2021-21166 to the Known Exploited Vulnerabilities catalog on 2021-11-03, confirming the flaw is being exploited in the wild, though ransomware use is unknown and no public proof-of-concept is available. EPSS currently assigns a 26.7% probability of exploitation within 30 days (98th percentile), and CVSS scoring has not yet been published.

Do: Apply the latest patched releases of all Chromium-based browsers in use (Chrome, Edge, Opera, and any derived browsers) per vendor instructions, as required by CISA's KEV listing. Prioritize managed endpoints and any systems where users browse untrusted or internet-facing websites, verify fleet-wide browser versions after updating, and monitor CISA/vendor advisories for ransomware-associated activity since that linkage is currently unknown.

CVE-2021-21193 is a use-after-free (CWE-416) in the Blink rendering engine of Google Chrome, with a CVSS 3.1 score of 8.8 (high). It is triggered when a user loads a crafted HTML page in an affected browser, allowing a remote attacker to corrupt heap memory and potentially execute code in the browser renderer process; the attack requires user interaction but no privileges. Anyone running Google Chrome prior to 89.0.4389.90 is affected, as are users of Fedora and Debian systems running Chromium-based browser packages built from the vulnerable code, per the CISA-supplied vendor and product list. Exploitation is confirmed in the wild: the CVE was added to the CISA KEV on 2021-11-03 with a required action of applying vendor updates, and multiple headlines report zero-day attacks against Chrome that were patched by Google. EPSS estimates a 9.9% probability of exploitation in the next 30 days (95th percentile), and no public proof-of-concept is known.

Do: Upgrade Google Chrome to 89.0.4389.90 or later immediately; Fedora and Debian users should apply the updated Chromium packages through their distro security repositories, checking their package manager for the patched version. Because the flaw is being exploited in the wild and requires only that a user open a crafted HTML page, prioritize this patch across all endpoints and treat untrusted web links with caution until browsers are updated; CISA KEV requires remediation per vendor instructions by the designated due date.

Google Chrome and Chromium versions prior to 89.0.4389.128 contain a use-after-free flaw (CWE-416) in the Blink rendering engine. A remote attacker can trigger it by luring a user into opening a crafted HTML page, requiring no privileges and only user interaction, which corrupts browser process memory (heap corruption) and can potentially allow arbitrary code execution within the browser. All users of Chrome or Chromium builds older than 89.0.4389.128 are affected, including the Chromium package shipped by Fedora. Google fixed the bug as an actively exploited zero-day in the same release as CVE-2021-21205, and CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03; EPSS estimates a 9.3% probability of exploitation within 30 days (95th percentile).

Do: Upgrade Google Chrome/Chromium to 89.0.4389.128 or later (verify via chrome://settings/help) and apply Fedora's updated chromium package, then restart the browser so the fix takes effect. Because the flaw is listed in CISA's KEV catalog and was exploited in the wild, prioritize patching for internet-exposed and high-risk users; no public PoC is known, but treat in-the-wild exploitation as confirmed.

CVE-2021-21224 is a type confusion vulnerability (CWE-843) in V8, the JavaScript engine used by Google Chrome and Chromium. An attacker triggers it by luring a user to open a crafted HTML page, causing V8 to mishandle object types during execution. Successful exploitation yields arbitrary code execution inside the Chrome renderer's sandbox, typically chained with a separate sandbox escape for full host compromise. Anyone running Google Chrome prior to 90.0.4430.85, or Chromium as packaged by Debian and Fedora, is affected. Exploitation is confirmed in the wild: Google shipped the fix in April 2021 after active attacks, a public PoC exists (crbug.com/1195777), the bug was observed in exploit-kit attack chains, EPSS assigns an 84% probability of near-term exploitation, and CISA added it to the KEV catalog on 2021-11-03.

Do: Update Google Chrome to 90.0.4430.85 or later immediately; Debian and Fedora users should apply the chromium package updates issued by their vendors, per CISA KEV required actions. There is no strong workaround short of disabling JavaScript or restricting browsing to trusted sites. Treat this as urgent, since the flaw was already used in real attacks and exploit-kit chains, where it was typically paired with a sandbox escape for full system compromise.

CVE-2021-30551 is a type confusion flaw (CWE-843) in the V8 JavaScript engine used by Google Chrome and Chromium, which can lead to heap corruption. An attacker triggers it by persuading a user to open a specially crafted HTML page — the browser bug requires user interaction but no privileges or authentication. Successful exploitation could allow a remote attacker to execute code or otherwise corrupt the browser process, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.8). Anyone running Google Chrome prior to 91.0.4472.101, including Chromium-based packages such as Fedora's chromium, is affected. The flaw was exploited as a zero-day before the fix was released, with Google attributing recent Chrome zero-day attacks including this issue to campaigns against Armenian targets linked to a commercial spyware vendor, and it is listed in CISA's Known Exploited Vulnerabilities catalog.

Do: Update Google Chrome to 91.0.4472.101 or later (via chrome://settings/help) and update Fedora's chromium package to the patched build, then verify the version in chrome://version. Fedora/Chromium administrators should apply vendor updates per CISA KEV guidance. Until patched, treat web browsing as a risk vector and avoid opening untrusted links, since exploitation requires loading a crafted web page.

CVE-2021-30554 is a use-after-free vulnerability (CWE-416) in the WebGL component of Google Chrome and the Chromium engine. A remote attacker triggers it by persuading a user to open a crafted HTML page that runs malicious WebGL content, requiring no privileges beyond user interaction. Successful exploitation causes heap corruption, which can potentially enable arbitrary code execution, with the high confidentiality, integrity, and availability impact reflected in its 8.8 CVSS score. Every Chrome/Chromium build prior to 91.0.4472.114 is affected, including Fedora's Chromium package built from that code. The flaw was actively exploited as a zero-day before the fix, is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03, required action: apply vendor updates), and EPSS assigns a 7.4% probability of exploitation within 30 days (94th percentile).

Do: Upgrade Google Chrome to 91.0.4472.114 or later (verify the running version via chrome://settings/help) and apply the corresponding Fedora Chromium update, since the upstream fix landed in Chromium 91.0.4472.114 and is carried in all subsequent releases. Other Chromium-based browsers inherit the fix through their own vendors' updates, so patch those as soon as they ship it. This CVE is in CISA's KEV catalog with active exploitation, so prioritize patching, especially for users who browse untrusted web content, rather than waiting for a routine patch cycle.

CVE-2021-30563 is a type confusion vulnerability (CWE-843) in the V8 JavaScript engine used by Google Chrome and Chromium. A remote attacker triggers it by luring a user to a crafted HTML page, where mistyped objects in V8 can corrupt the heap. Successful exploitation can lead to heap corruption that the attacker can leverage for code execution within the browser renderer process. Anyone running Google Chrome prior to 91.0.4472.164, or a Chromium-based browser built on the vulnerable V8, is affected. The flaw is confirmed exploited in the wild: it was patched as an actively exploited Chrome zero-day and was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03.

Do: Upgrade Google Chrome to 91.0.4472.164 or later immediately (verify the installed version via Help > About Chrome); users of Chromium-based browsers should install their vendor's update containing the patched V8. Because in-the-wild exploitation is confirmed (CISA KEV), treat this as urgent patching and confirm auto-update has actually completed rather than assuming it.

CVE-2021-30632 is an out-of-bounds write (CWE-787) in V8, the JavaScript engine used by Google Chrome and other Chromium-based browsers, affecting Chrome versions prior to 93.0.4577.82. A remote attacker can trigger the flaw by luring a user to a crafted HTML page, since the vulnerable code is reached when the browser processes attacker-supplied web content (user interaction is required per the CVSS vector). Successful exploitation corrupts the heap and can allow the attacker to execute code within the browser process, with high impact on confidentiality, integrity, and availability. Anyone running an unpatched version of Chrome or Chromium — including Fedora's packaged Chromium/Chrome — is affected. The vulnerability was known to be actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03, EPSS assigns a 63.2% probability of exploitation within 30 days, and it was among the 15+ Chrome zero-days Google patched during 2021, though no public proof-of-concept is known.

Do: Update Google Chrome to 93.0.4577.82 or later on all platforms and restart the browser so the new V8 is loaded; on Fedora, apply the updated chromium/chrome packages through the normal update channel. Because this flaw is on the CISA KEV catalog, federal and critical-infrastructure teams should patch per vendor instructions on the required timeline; defenders should also verify no unmanaged or Kiosk-style Chromium installs remain below the fixed version.

Google Chromium's Indexed DB API contains a use-after-free (CWE-416) that a remote attacker who has already compromised the browser's renderer process can trigger via a crafted HTML page to escape the Chromium sandbox. Because the bug requires a prior renderer compromise, it is typically used as a second stage in exploit chains rather than as a standalone attack. Successful exploitation allows code to break out of the browser sandbox and run with elevated privileges on the victim's host. Any user of a Chromium-based browser on an unpatched build is affected, including Google Chrome, Microsoft Edge, Opera, and other Chromium derivatives. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), indicating active exploitation, and EPSS assigns a 32.7% probability of exploitation within 30 days (98th percentile).

Do: Apply vendor updates immediately per CISA's required action: Google Chrome 94.0.4606.81 or later fixes the flaw, and Microsoft Edge, Opera, Brave and other Chromium-based browsers should be updated to builds incorporating the equivalent Chromium patch. Inventory browser versions fleet-wide and verify that no legacy or unmanaged Chromium installs remain, prioritizing hosts whose users browse untrusted web content. Because in-the-wild exploitation is confirmed (CISA KEV, added 2021-11-03) and this bug is typically chained after a renderer compromise, keep all Chromium components fully patched rather than remediating this flaw in isolation.

CVE-2021-37973 is a use-after-free (CWE-416) in the Portals feature of Google Chrome prior to 94.0.4606.61. It is triggered via a crafted HTML page, and per the vendor description it allows a remote attacker who has already compromised the renderer process to potentially escape Chrome's sandbox; the CVSS vector confirms network reachability with required user interaction (UI:R). A successful exploit turns a renderer-level compromise into code execution outside the sandbox, with high impact to confidentiality, integrity, and availability (scope change, 9.6 critical). Anyone running Chrome or Chromium builds before 94.0.4606.61 is affected, including the chromium packages shipped by Fedora and Debian. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2021-11-03, Google patched it as one of two actively exploited Chrome zero-days (EPSS 11.6%, 96th percentile), no public PoC is known, and related reporting ties the era's actively exploited Chrome zero-days to mercenary spyware such as Intellexa/Cytrox's Predator.

Do: Upgrade Google Chrome to 94.0.4606.61 or later (confirm the running version at chrome://version) and update the chromium packages on Fedora and Debian to their patched builds. Because the flaw is on the CISA KEV list, applying vendor updates is required for federal and critical-infrastructure environments; enable automatic browser updates and prioritize patching where users browse untrusted web content, since exploitation is typically delivered via crafted pages in a chain.

A memory implementation flaw (inappropriate implementation, tracked as CWE-862) in Google Chrome and Chromium prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from browser process memory. The flaw is reachable over the network with low complexity: an attacker needs no privileges but must convince a user (user interaction required) to load a crafted HTML page, e.g. by visiting an attacker-controlled website. A successful attacker gains read access to potentially sensitive data from the affected process's memory, with no direct impact on integrity or availability per the CVSS score. All Chrome/Chromium users running builds older than 94.0.4606.71 are affected, including Chromium as packaged and distributed by Fedora and Debian. The vulnerability is confirmed exploited in the wild: it was added to CISA's KEV on 2021-11-03 (ransomware use unknown), EPSS puts 30-day exploitation probability at 19.7% (97th percentile), and reporting around the Intellexa leaks ties the Chrome zero-day fixes of this period to Cytrox/Predator mercenary spyware operations.

Do: Upgrade Google Chrome/Chromium to 94.0.4606.71 or later immediately, per the CISA KEV required action; on Fedora and Debian, apply the distribution's Chromium security updates. Audit endpoints for browser versions below 94.0.4606.71 and prioritize internet-facing or high-value users given known in-the-wild exploitation and links to Predator spyware campaigns. No reliable mitigation short of updating exists; restricting browsing with unpatched builds reduces exposure.

CVE-2021-38000 is an insufficient input validation flaw in the Intents component of Google Chrome on Android (CWE-20/CWE-601), allowing a remote attacker to make the browser navigate to an arbitrary, attacker-chosen URL by luring the user to a crafted HTML page. It is essentially a forced-navigation/open-redirect bug: the user must interact with the malicious page (user interaction required), and the attacker gains limited confidentiality and integrity impact by steering the browser to a malicious URL, which is typically chained with other flaws. The bug was fixed in Chrome 95.0.4638.69 for Android, and the flaw is also tracked against Chromium packages distributed in Fedora and Debian. It carries a CVSS 3.1 score of 6.1 (medium) and an EPSS of 4.7% (91st percentile). Exploitation is confirmed in the wild: it was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03, and contemporaneous headlines describe Google patching actively exploited Chrome zero-days, with press reports linking Chrome zero-day attacks on Android users to Predator spyware campaigns.

Do: Update Chrome on Android to version 95.0.4638.69 or later — since Chrome auto-updates, verify the installed version via Settings > About Chrome on managed and BYOD devices. Fedora and Debian users should install the current Chromium/Chrome security updates from their distribution. Inventory mobile fleets and internet-facing kiosk/device estates for Chrome builds below 95.0.4638.69 and treat user lures to crafted web pages as the primary delivery vector.

CVE-2021-38003 is a memory corruption flaw in the V8 JavaScript engine used by Chromium, in which the engine's internal 'TheHole' sentinel value can leak into script-visible data during JSON.stringify processing (a heap-corruption condition tracked as CWE-122 and CWE-755). It is triggered when crafted JavaScript causes JSON.stringify to expose this internal value to script code. An attacker who can induce a victim to load malicious web content can leverage the resulting corruption, typically chained with further techniques, to execute code within the browser renderer or crash it. All users of Chromium-based browsers — explicitly including Google Chrome, Microsoft Edge, and Opera, and by extension other Chromium derivatives — are affected. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2021-11-03, carries a 38.6% EPSS probability of exploitation within 30 days (98th percentile), and no public proof-of-concept is known.

Do: Update all Chromium-based browsers (Chrome, Edge, Opera, and any Chromium-embedded or Electron-style applications in your estate) to the latest vendor-patched releases, per the CISA KEV required action to apply updates per vendor instructions. Verify remediated browser versions via enterprise update management and browser version reporting, prioritizing user workstations and externally reachable systems. Because exploitation is confirmed in the wild, treat unpatched Chromium browsers as an active exposure rather than a theoretical risk.