Google fixes the third actively exploited Chrome 0

Google Chrome bundles the open-source FreeType library for font rendering, and that library contains a heap buffer overflow (CWE-787, out-of-bounds write) in its Load_SBit_Png function. The flaw is triggered when the browser loads a crafted font containing a malicious PNG image embedded as embedded bitmap data, typically from a web page the victim visits, corrupting heap memory with attacker-controlled data. Successful exploitation can crash the browser or execute code in the renderer, and it was used in the wild as part of an exploit chain combined with CVE-2020-17087 (Windows kernel) and CVE-2020-16010 (Android) to escape the sandbox. Anyone running an affected Google Chrome release that ships the vulnerable FreeType code, across Windows, macOS, Linux, Chrome OS and Android, is affected, meaning effectively the entire Chrome install base at the time of disclosure. The vulnerability is confirmed exploited in the wild (listed in CISA's KEV catalog, added 2021-11-03; ransomware use unknown), Google patched it in Chrome 86.0.4240.111, no public proof-of-concept is known, and EPSS estimates a 44.3% probability of exploitation within 30 days (99th percentile).

Do: Update Google Chrome to 86.0.4240.111 or later (any current stable-channel release satisfies this), and where other software bundles FreeType directly, update to FreeType 2.10.4 or later per the upstream fix. Because the bug was chained with CVE-2020-17087 on Windows and CVE-2020-16010 on Android, also apply the corresponding Microsoft Windows and Android updates to close the sandbox-escape chain. Use endpoint management to inventory browser versions and confirm no endpoints remain below the fixed release, as required by the CISA KEV catalog.

CVE-2020-16009 is a type confusion vulnerability (CWE-843) in the V8 JavaScript engine used by Google Chromium, which can lead to heap corruption (CWE-787). A remote attacker triggers it by getting a user to load a specially crafted HTML page, such as via a malicious or compromised website. Successful exploitation corrupts the heap and can potentially allow the attacker to execute code in the context of the affected browser. Any Chromium-based browser or application embedding V8 is affected, including Google Chrome, Microsoft Edge, and Opera, meaning the affected population is effectively the entire Chromium user base worldwide. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2021-11-03, confirming exploitation in the wild, with an EPSS probability of 48.3% (99th percentile); ransomware use is unknown and no public PoC is known.

Do: Apply the vendor update per CISA's required action: update all Chromium-based browsers (Chrome, Edge, Opera, and derivatives) to the latest stable releases from each vendor and restart browsers afterward. Inventory any embedded or packaged Chromium/V8 runtimes in other applications and update them as their maintainers ship fixes. Given confirmed in-the-wild exploitation and high EPSS, prioritize patching endpoints used for web browsing by high-risk users first.

CVE-2020-16010 is a heap buffer overflow (out-of-bounds write, CWE-787/CWE-122) in the UI layer of Google Chrome on Android, fixed in version 86.0.4240.185. It is triggered by a crafted HTML page after a remote attacker has already compromised the Chrome renderer process, meaning it typically functions as a second-stage component of an exploit chain. Successful exploitation lets the attacker escape Chrome's sandbox, moving from the isolated renderer to broader access on the device, with confidentiality, integrity, and availability all rated high (CVSS 3.1: 9.6). Users running Chrome on Android prior to 86.0.4240.185 are affected. The flaw is confirmed exploited in the wild — it was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 — and EPSS assigns a 6.4% probability of exploitation in the next 30 days (93rd percentile).

Do: Update Chrome on Android to 86.0.4240.185 or later via Google Play and confirm the version on the device (chrome://version); given the CISA KEV listing, treat this patch as urgent. Because the bug requires a prior renderer compromise, also ensure the device's Chrome build includes all current renderer fixes, and enable Play Store auto-updates on managed fleets.

Google Chrome's V8 JavaScript engine contained an inappropriate implementation (CWE-787, out-of-bounds write) that could corrupt the browser's heap. A remote attacker triggers the flaw by getting a user to open a crafted HTML page, since the bug is reached through JavaScript processing in the browser (user interaction is required, per the CVSS vector). Successful exploitation could allow the attacker to execute code in the browser with high confidentiality, integrity and availability impact, consistent with the 8.8 CVSS score. All Google Chrome users running versions prior to 86.0.4240.198 were affected, as are Chromium-based builds relying on the same V8 code. The flaw was a zero-day under active attack when Google patched it in the November 2020 stable-channel update; it was added to CISA KEV on 2021-11-03 (ransomware use unknown), carries a 2.8% EPSS (85th percentile), and no public PoC is known.

Do: Upgrade Google Chrome to 86.0.4240.198 or later on all endpoints and verify the running version at chrome://version; this is the November 2020 stable-channel release that patched the actively exploited zero-day. Chromium-based browsers (e.g., Edge, Brave, Opera, Vivaldi) inherit the V8 fix through their own upstream updates, so ensure the latest available release is deployed there as well. As a CISA KEV entry, the required action is to apply vendor updates per vendor instructions within the KEV patching deadline.

CVE-2020-16017 is a use-after-free vulnerability in the site isolation component of Google Chrome, fixed in version 86.0.4240.198. It is triggered by a crafted HTML page and requires the attacker to have already compromised the renderer process, for example via a chained renderer bug. By exploiting the flaw, the attacker can escape Chrome's renderer sandbox and gain code execution with broader privileges on the host system. Any user running an affected Chrome release prior to 86.0.4240.198 is exposed. The flaw was a zero-day exploited in active attacks at the time of disclosure, is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), and Google shipped the fix as an urgent stable-channel update.

Do: Update Google Chrome to version 86.0.4240.198 or later and verify the installed version in the browser's About dialog; enable automatic updates so renderer/sandbox fixes are applied promptly. Administrators should audit managed endpoints for outdated Chrome builds and prioritize updates given the confirmed in-the-wild exploitation and KEV listing; the required action per CISA is to apply updates per vendor instructions.

CVE-2021-21148 is a heap buffer overflow (out-of-bounds write, CWE-787) in the V8 JavaScript engine used by Google Chrome and Chromium. A remote attacker triggers it by getting a user to open a crafted HTML page, so user interaction is required, but no privileges or special access are needed. Successful exploitation corrupts the heap and can allow the attacker to run code within the browser, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.8). All Chrome/Chromium builds prior to 88.0.4324.150 are affected, including the chromium packages shipped in Fedora and Debian. Google patched the flaw in an emergency update for what headlines described as a Chrome zero-day, and its inclusion in the CISA Known Exploited Vulnerabilities catalog (added 2021-11-03) confirms exploitation in the wild, despite no public PoC; EPSS estimates a 20% probability of exploitation over the next 30 days (97th percentile).

Do: Upgrade Google Chrome/Chromium to 88.0.4324.150 or later on all endpoints, and install the updated chromium packages from Fedora and Debian. Verify fleet-wide browser versions, since a single user opening a malicious page is enough for compromise, and confirm auto-update is enabled on managed browsers.

Google Chromium contains a race condition (CWE-362) that can lead to heap corruption (CWE-122) when the browser processes a crafted HTML page, meaning an attacker can trigger the flaw simply by getting a user to visit an attacker-controlled or malicious webpage. Successful exploitation of the heap corruption could crash the browser and potentially allow the attacker to execute code within the affected browser process. Because the vulnerable code is in the Chromium engine itself, all Chromium-based browsers are potentially affected, including Google Chrome, Microsoft Edge, Opera, and other derived browsers, across desktop and mobile fleets. CISA added CVE-2021-21166 to the Known Exploited Vulnerabilities catalog on 2021-11-03, confirming the flaw is being exploited in the wild, though ransomware use is unknown and no public proof-of-concept is available. EPSS currently assigns a 26.7% probability of exploitation within 30 days (98th percentile), and CVSS scoring has not yet been published.

Do: Apply the latest patched releases of all Chromium-based browsers in use (Chrome, Edge, Opera, and any derived browsers) per vendor instructions, as required by CISA's KEV listing. Prioritize managed endpoints and any systems where users browse untrusted or internet-facing websites, verify fleet-wide browser versions after updating, and monitor CISA/vendor advisories for ransomware-associated activity since that linkage is currently unknown.

Heap buffer overflow in tab groups in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2021-21193 is a use-after-free (CWE-416) in the Blink rendering engine of Google Chrome, with a CVSS 3.1 score of 8.8 (high). It is triggered when a user loads a crafted HTML page in an affected browser, allowing a remote attacker to corrupt heap memory and potentially execute code in the browser renderer process; the attack requires user interaction but no privileges. Anyone running Google Chrome prior to 89.0.4389.90 is affected, as are users of Fedora and Debian systems running Chromium-based browser packages built from the vulnerable code, per the CISA-supplied vendor and product list. Exploitation is confirmed in the wild: the CVE was added to the CISA KEV on 2021-11-03 with a required action of applying vendor updates, and multiple headlines report zero-day attacks against Chrome that were patched by Google. EPSS estimates a 9.9% probability of exploitation in the next 30 days (95th percentile), and no public proof-of-concept is known.

Do: Upgrade Google Chrome to 89.0.4389.90 or later immediately; Fedora and Debian users should apply the updated Chromium packages through their distro security repositories, checking their package manager for the patched version. Because the flaw is being exploited in the wild and requires only that a user open a crafted HTML page, prioritize this patch across all endpoints and treat untrusted web links with caution until browsers are updated; CISA KEV requires remediation per vendor instructions by the designated due date.