Update Your Chrome Browser to Patch 2 New In-the-Wild 0

CVE-2021-21148 is a heap buffer overflow (out-of-bounds write, CWE-787) in the V8 JavaScript engine used by Google Chrome and Chromium. A remote attacker triggers it by getting a user to open a crafted HTML page, so user interaction is required, but no privileges or special access are needed. Successful exploitation corrupts the heap and can allow the attacker to run code within the browser, with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.8). All Chrome/Chromium builds prior to 88.0.4324.150 are affected, including the chromium packages shipped in Fedora and Debian. Google patched the flaw in an emergency update for what headlines described as a Chrome zero-day, and its inclusion in the CISA Known Exploited Vulnerabilities catalog (added 2021-11-03) confirms exploitation in the wild, despite no public PoC; EPSS estimates a 20% probability of exploitation over the next 30 days (97th percentile).

Do: Upgrade Google Chrome/Chromium to 88.0.4324.150 or later on all endpoints, and install the updated chromium packages from Fedora and Debian. Verify fleet-wide browser versions, since a single user opening a malicious page is enough for compromise, and confirm auto-update is enabled on managed browsers.

Google Chromium contains a race condition (CWE-362) that can lead to heap corruption (CWE-122) when the browser processes a crafted HTML page, meaning an attacker can trigger the flaw simply by getting a user to visit an attacker-controlled or malicious webpage. Successful exploitation of the heap corruption could crash the browser and potentially allow the attacker to execute code within the affected browser process. Because the vulnerable code is in the Chromium engine itself, all Chromium-based browsers are potentially affected, including Google Chrome, Microsoft Edge, Opera, and other derived browsers, across desktop and mobile fleets. CISA added CVE-2021-21166 to the Known Exploited Vulnerabilities catalog on 2021-11-03, confirming the flaw is being exploited in the wild, though ransomware use is unknown and no public proof-of-concept is available. EPSS currently assigns a 26.7% probability of exploitation within 30 days (98th percentile), and CVSS scoring has not yet been published.

Do: Apply the latest patched releases of all Chromium-based browsers in use (Chrome, Edge, Opera, and any derived browsers) per vendor instructions, as required by CISA's KEV listing. Prioritize managed endpoints and any systems where users browse untrusted or internet-facing websites, verify fleet-wide browser versions after updating, and monitor CISA/vendor advisories for ransomware-associated activity since that linkage is currently unknown.

CVE-2021-21193 is a use-after-free (CWE-416) in the Blink rendering engine of Google Chrome, with a CVSS 3.1 score of 8.8 (high). It is triggered when a user loads a crafted HTML page in an affected browser, allowing a remote attacker to corrupt heap memory and potentially execute code in the browser renderer process; the attack requires user interaction but no privileges. Anyone running Google Chrome prior to 89.0.4389.90 is affected, as are users of Fedora and Debian systems running Chromium-based browser packages built from the vulnerable code, per the CISA-supplied vendor and product list. Exploitation is confirmed in the wild: the CVE was added to the CISA KEV on 2021-11-03 with a required action of applying vendor updates, and multiple headlines report zero-day attacks against Chrome that were patched by Google. EPSS estimates a 9.9% probability of exploitation in the next 30 days (95th percentile), and no public proof-of-concept is known.

Do: Upgrade Google Chrome to 89.0.4389.90 or later immediately; Fedora and Debian users should apply the updated Chromium packages through their distro security repositories, checking their package manager for the patched version. Because the flaw is being exploited in the wild and requires only that a user open a crafted HTML page, prioritize this patch across all endpoints and treat untrusted web links with caution until browsers are updated; CISA KEV requires remediation per vendor instructions by the designated due date.

Google Chrome and Chromium versions prior to 89.0.4389.128 contain a use-after-free flaw (CWE-416) in the Blink rendering engine. A remote attacker can trigger it by luring a user into opening a crafted HTML page, requiring no privileges and only user interaction, which corrupts browser process memory (heap corruption) and can potentially allow arbitrary code execution within the browser. All users of Chrome or Chromium builds older than 89.0.4389.128 are affected, including the Chromium package shipped by Fedora. Google fixed the bug as an actively exploited zero-day in the same release as CVE-2021-21205, and CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03; EPSS estimates a 9.3% probability of exploitation within 30 days (95th percentile).

Do: Upgrade Google Chrome/Chromium to 89.0.4389.128 or later (verify via chrome://settings/help) and apply Fedora's updated chromium package, then restart the browser so the fix takes effect. Because the flaw is listed in CISA's KEV catalog and was exploited in the wild, prioritize patching for internet-exposed and high-risk users; no public PoC is known, but treat in-the-wild exploitation as confirmed.

CVE-2021-21220 is an insufficient input validation flaw (CWE-787, out-of-bounds write) in the V8 JavaScript engine used by Google Chrome, affecting Chrome versions prior to 89.0.4389.128. A remote attacker can trigger the flaw by persuading a user to open a crafted HTML page, causing V8 to mishandle untrusted input and corrupt the heap. Successful exploitation can lead to heap corruption and potential remote code execution in the browser, with no privileges required beyond user interaction. The flaw affects Chrome and Chromium-based builds that ship the vulnerable V8 engine, including Fedora's Chromium package. It was exploited in the wild as a zero-day before the April 2021 fix, is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), and related reporting notes attacks using the disclosed Chromium exploit against WeChat users.

Do: Update Google Chrome to version 89.0.4389.128 or later (ideally the current stable release); Fedora users should apply the updated Chromium package from their distribution repositories. Because the flaw is in the CISA KEV catalog, federal and KEV-bound organizations must patch per vendor instructions, and users of other Chromium-based browsers should verify their underlying V8/Chromium version has incorporated the fix.