CVE-2021-21143
Heap buffer overflow in Extensions in Google Chrome prior to 88.0.4324.146 allowed an attacker...
8.8 HighFix available
Heap buffer overflow in Extensions in Google Chrome prior to 88.0.4324.146 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
0.83%Up 0.4 points since Apr 14, 2021
What each source reports
NVD Score used
Heap buffer overflow in Extensions in Google Chrome prior to 88.0.4324.146 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.
- Record
CVE-2021-21143- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE ListNo score
Heap buffer overflow in Extensions in Google Chrome prior to 88.0.4324.146 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.
- Record
CVE-2021-21143- Updated
- 2026-11-02
EUVDEUVD-2021-8534No score
Heap buffer overflow in Extensions in Google Chrome prior to 88.0.4324.146 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.
- Record
EUVD-2021-8534- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-ww6m-3fjc-mvfw
Heap buffer overflow in Extensions in Google Chrome prior to 88.0.4324.146 allowed an attacker...
Heap buffer overflow in Extensions in Google Chrome prior to 88.0.4324.146 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.
- Record
GHSA-ww6m-3fjc-mvfw- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
Heap buffer overflow in Extensions in Google Chrome prior to 88.0.4324.146 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.
- Record
CVE-2021-21143- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-21143
Heap buffer overflow in Extensions in Google Chrome prior to 88.0.4324.146 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.
- Record
DEBIAN-CVE-2021-21143- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2021-21143
Heap buffer overflow in Extensions in Google Chrome prior to 88.0.4324.146 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.
- Record
UBUNTU-CVE-2021-21143- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0259-1No score
Security update for chromium
This update for chromium fixes the following issues:
- Update to 88.0.4324.146 boo#1181772
- CVE-2021-21142: Use after free in Payments
- CVE-2021-21143: Heap buffer overflow in Extensions
- CVE-2021-21144: Heap buffer overflow in Tab Groups.
- CVE-2021-21145: Use after free in Fonts
- CVE-2021-21146: Use after free in Navigation.
- CVE-2021-21147: Inappropriate implementation in Skia
- Record
openSUSE-SU-2021:0259-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0268-1No score
Security update for chromium
This update for chromium fixes the following issues:
- Update to 88.0.4324.146 boo#1181772
- CVE-2021-21142: Use after free in Payments
- CVE-2021-21143: Heap buffer overflow in Extensions
- CVE-2021-21144: Heap buffer overflow in Tab Groups.
- CVE-2021-21145: Use after free in Fonts
- CVE-2021-21146: Use after free in Navigation.
- CVE-2021-21147: Inappropriate implementation in Skia
This update was imported from the openSUSE:Leap:15.2:Update update project.
- Record
openSUSE-SU-2021:0268-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10681-1No score
chromedriver-93.0.4577.82-1.1 on GA media
These are all security issues fixed in the chromedriver-93.0.4577.82-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10681-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12948-1No score
ungoogled-chromium-113.0.5672.92-1.1 on GA media
These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12948-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromiumDebian:12 | before 88.0.4324.146-1 | 88.0.4324.146-1 |
chromiumDebian:13 | before 88.0.4324.146-1 | 88.0.4324.146-1 |
chromiumDebian:14 | before 88.0.4324.146-1 | 88.0.4324.146-1 |
chromiumDebian:10 From an advisory covering 32 CVEs | before 88.0.4324.146-1~deb10u1, plus listed versions 73.0.3683.75-174.0.3729.108-175.0.3770.10-175.0.3770.80-175.0.3770.90-1 Show 45 moreShow less76.0.3809.100-176.0.3809.100-1~deb10u176.0.3809.62-176.0.3809.71-176.0.3809.87-176.0.3809.87-278.0.3904.108-178.0.3904.108-1~deb10u178.0.3904.87-178.0.3904.97-178.0.3904.97-1~deb10u179.0.3945.130-179.0.3945.130-1~deb10u179.0.3945.130-279.0.3945.56-179.0.3945.79-180.0.3987.106-180.0.3987.116-180.0.3987.122-180.0.3987.122-280.0.3987.132-180.0.3987.132-1~deb10u180.0.3987.149-180.0.3987.149-1~deb10u180.0.3987.162-180.0.3987.162-1~deb10u181.0.4044.62-181.0.4044.92-183.0.4103.106-183.0.4103.116-183.0.4103.116-1~deb10u183.0.4103.116-1~deb10u283.0.4103.116-1~deb10u383.0.4103.116-283.0.4103.116-383.0.4103.116-3.183.0.4103.83-184.0.4147.105-184.0.4147.89-187.0.4280.141-0.187.0.4280.141-0.1~deb10u187.0.4280.88-0.187.0.4280.88-0.287.0.4280.88-0.387.0.4280.88-0.4 | 88.0.4324.146-1~deb10u1 |
chromium-browserUbuntu:16.04:LTS | before 89.0.4389.82-0ubuntu0.16.04.1, plus listed versions 45.0.2454.101-0ubuntu1.120147.0.2526.73-0ubuntu1.121847.0.2526.106-0ubuntu1.122148.0.2564.82-0ubuntu1.122248.0.2564.116-0ubuntu1.1229 Show 45 moreShow less49.0.2623.87-0ubuntu1.123249.0.2623.108-0ubuntu1.123350.0.2661.102-0ubuntu0.16.04.1.123751.0.2704.79-0ubuntu0.16.04.1.124252.0.2743.116-0ubuntu0.16.04.1.125053.0.2785.143-0ubuntu0.16.04.1.125453.0.2785.143-0ubuntu0.16.04.1.125755.0.2883.87-0ubuntu0.16.04.126356.0.2924.76-0ubuntu0.16.04.126857.0.2987.98-0ubuntu0.16.04.127658.0.3029.81-0ubuntu0.16.04.127758.0.3029.96-0ubuntu0.16.04.127958.0.3029.110-0ubuntu0.16.04.128159.0.3071.109-0ubuntu0.16.04.128959.0.3071.109-0ubuntu0.16.04.129160.0.3112.78-0ubuntu0.16.04.129360.0.3112.113-0ubuntu0.16.04.129861.0.3163.79-0ubuntu0.16.04.130061.0.3163.100-0ubuntu0.16.04.130662.0.3202.62-0ubuntu0.16.04.130862.0.3202.75-0ubuntu0.16.04.131362.0.3202.89-0ubuntu0.16.04.131562.0.3202.94-0ubuntu0.16.04.131763.0.3239.84-0ubuntu0.16.04.163.0.3239.132-0ubuntu0.16.04.164.0.3282.119-0ubuntu0.16.04.164.0.3282.140-0ubuntu0.16.04.164.0.3282.167-0ubuntu0.16.04.165.0.3325.181-0ubuntu0.16.04.166.0.3359.139-0ubuntu0.16.04.366.0.3359.181-0ubuntu0.16.04.167.0.3396.99-0ubuntu0.16.04.268.0.3440.75-0ubuntu0.16.04.168.0.3440.106-0ubuntu0.16.04.169.0.3497.81-0ubuntu0.16.04.170.0.3538.67-0ubuntu0.16.04.170.0.3538.77-0ubuntu0.16.04.170.0.3538.110-0ubuntu0.16.04.171.0.3578.80-0ubuntu0.16.04.171.0.3578.98-0ubuntu0.16.04.172.0.3626.119-0ubuntu0.16.04.172.0.3626.121-0ubuntu0.16.04.173.0.3683.75-0ubuntu0.16.04.173.0.3683.86-0ubuntu0.16.04.174.0.3729.169-0ubuntu0.16.04.1 | 89.0.4389.82-0ubuntu0.16.04.1 |
chromium-browserUbuntu:18.04:LTS | before 89.0.4389.82-0ubuntu0.18.04.1, plus listed versions 61.0.3163.100-0ubuntu1.137862.0.3202.62-0ubuntu0.17.10.138062.0.3202.89-0ubuntu1.138662.0.3202.94-0ubuntu1.138863.0.3239.84-0ubuntu1 Show 44 moreShow less63.0.3239.108-0ubuntu164.0.3282.119-0ubuntu164.0.3282.140-0ubuntu164.0.3282.167-0ubuntu165.0.3325.146-0ubuntu165.0.3325.181-0ubuntu166.0.3359.139-0ubuntu0.18.04.366.0.3359.181-0ubuntu0.18.04.167.0.3396.99-0ubuntu0.18.04.168.0.3440.75-0ubuntu0.18.04.168.0.3440.106-0ubuntu0.18.04.169.0.3497.81-0ubuntu0.18.04.170.0.3538.67-0ubuntu0.18.04.170.0.3538.77-0ubuntu0.18.04.170.0.3538.110-0ubuntu0.18.04.171.0.3578.80-0ubuntu0.18.04.171.0.3578.98-0ubuntu0.18.04.172.0.3626.119-0ubuntu0.18.04.172.0.3626.121-0ubuntu0.18.04.173.0.3683.75-0ubuntu0.18.04.173.0.3683.86-0ubuntu0.18.04.174.0.3729.169-0ubuntu0.18.04.175.0.3770.90-0ubuntu0.18.04.175.0.3770.142-0ubuntu0.18.04.176.0.3809.87-0ubuntu0.18.04.176.0.3809.100-0ubuntu0.18.04.177.0.3865.90-0ubuntu0.18.04.178.0.3904.70-0ubuntu0.18.04.278.0.3904.97-0ubuntu0.18.04.178.0.3904.108-0ubuntu0.18.04.179.0.3945.79-0ubuntu0.18.04.179.0.3945.130-0ubuntu0.18.04.180.0.3987.87-0ubuntu0.18.04.180.0.3987.149-0ubuntu0.18.04.180.0.3987.163-0ubuntu0.18.04.181.0.4044.122-0ubuntu0.18.04.181.0.4044.138-0ubuntu0.18.04.183.0.4103.61-0ubuntu0.18.04.184.0.4147.105-0ubuntu0.18.04.185.0.4183.83-0ubuntu0.18.04.285.0.4183.121-0ubuntu0.18.04.186.0.4240.75-0ubuntu0.18.04.186.0.4240.198-0ubuntu0.18.04.187.0.4280.66-0ubuntu0.18.04.1 | 89.0.4389.82-0ubuntu0.18.04.1 |
chromiumopenSUSE:Leap 15.2 From an advisory covering 6 CVEs | before 88.0.4324.146-lp152.2.69.1 | 88.0.4324.146-lp152.2.69.1 |
chromiumSUSE:Package Hub 15 SP2 From an advisory covering 6 CVEs | before 88.0.4324.146-bp152.2.56.5 | 88.0.4324.146-bp152.2.56.5 |
chromiumopenSUSE:Tumbleweed From an advisory covering 1081 CVEs | before 93.0.4577.82-1.1 | 93.0.4577.82-1.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 2310 CVEs | before 113.0.5672.92-1.1 | 113.0.5672.92-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-21143 is a high vulnerability (CVSS 8.8) in Google Chrome, published February 7, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.83%, the 58th percentile. Fixed in chromium 88.0.4324.146-1.
References
chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop.html
crbug.com/1163504
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUQSMNV7INLDDSD3RKI5S5EAULX2QC7P
security.gentoo.org/glsa/202104-08
nvd.nist.gov/vuln/detail/CVE-2021-21143
Show 194 moreShow less
github.com/advisories/GHSA-ww6m-3fjc-mvfw
security-tracker.debian.org/tracker/CVE-2021-21143
ubuntu.com/security/CVE-2021-21143
cve.org/CVERecord?id=CVE-2021-21143
lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XCYZBSKAQDG7SYKEXASEZQODBJQKCMUZ
bugzilla.suse.com/1181772
suse.com/security/cve/CVE-2021-21142
This page doesn't list everything
Left out here: 23 versions and 2,125 references. The JSON record has them.