CVE-2021-21193
Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to...
8.8 HighIn KEVPublic exploitFix available
Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
9.95%Up 9.4 points since Apr 14, 2021
What each source reports
NVD Score used
Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Record
CVE-2021-21193- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-416
- Updated
- 2026-11-02
CVE List
Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Record
CVE-2021-21193- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
EUVDEUVD-2021-8584
Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Record
EUVD-2021-8584- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-hf6r-r2hj-f2g7
Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to...
Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Record
GHSA-hf6r-r2hj-f2g7- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-416
- Updated
- 2026-11-02
CISA KEV No score
Google Chromium Blink Use-After-Free Vulnerability
Google Chromium Blink contains a use-after-free vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Record
CVE-2021-21193- Weakness
- CWE-416
- Updated
- 2026-11-02
OSVALPINE-CVE-2021-21193
Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Record
ALPINE-CVE-2021-21193- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
Show 9 moreShow less
OSV
Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Record
CVE-2021-21193- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-21193
Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Record
DEBIAN-CVE-2021-21193- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-21193
Use after free in Blink in Google Chrome prior to 89.0.4389.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Record
UBUNTU-CVE-2021-21193- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2021-0142 No score
Updated chromium-browser-stable packages fix security vulnerability
The updated packages fix security vulnerabilities. At least one of them is known to be actively exploited.
- Record
MGASA-2021-0142- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0436-1 No score
Security update for chromium
This update for chromium fixes the following issues:
- Chromium was updated to 89.0.4389.90 (boo#1183515)
- CVE-2021-21191: Use after free in WebRTC.
- CVE-2021-21192: Heap buffer overflow in tab groups.
- CVE-2021-21193: Use after free in Blink.
- Record
openSUSE-SU-2021:0436-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0446-1 No score
Security update for chromium
This update for chromium fixes the following issues:
- Chromium was updated to 89.0.4389.90 (boo#1183515)
- CVE-2021-21191: Use after free in WebRTC.
- CVE-2021-21192: Heap buffer overflow in tab groups.
- CVE-2021-21193: Use after free in Blink.
This update was imported from the openSUSE:Leap:15.2:Update update project.
- Record
openSUSE-SU-2021:0446-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:0592-1 No score
Security update for opera
This update for opera fixes the following issues:
- Opera was updated to version 75.0.3969.171 (boo#1184256) CVE-2021-21194, CVE-2021-21195, CVE-2021-21196, CVE-2021-21197, CVE-2021-21198, CVE-2021-21199, CVE-2021-21191, CVE-2021-21192, CVE-2021-21193
- Record
openSUSE-SU-2021:0592-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10681-1 No score
chromedriver-93.0.4577.82-1.1 on GA media
These are all security issues fixed in the chromedriver-93.0.4577.82-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10681-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score
ungoogled-chromium-113.0.5672.92-1.1 on GA media
These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12948-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromiumAlpine:v3.14 |
before 89.0.4389.90-r0 | 89.0.4389.90-r0 |
chromiumAlpine:v3.15 |
before 89.0.4389.90-r0 | 89.0.4389.90-r0 |
chromiumAlpine:v3.16 |
before 89.0.4389.90-r0 | 89.0.4389.90-r0 |
chromiumAlpine:v3.17 |
before 89.0.4389.90-r0 | 89.0.4389.90-r0 |
chromiumAlpine:v3.18 |
before 89.0.4389.90-r0 | 89.0.4389.90-r0 |
chromiumAlpine:v3.19 |
before 89.0.4389.90-r0 | 89.0.4389.90-r0 |
chromiumAlpine:v3.20 |
before 89.0.4389.90-r0 | 89.0.4389.90-r0 |
chromiumAlpine:v3.21 |
before 89.0.4389.90-r0 | 89.0.4389.90-r0 |
chromiumAlpine:v3.22 |
before 89.0.4389.90-r0 | 89.0.4389.90-r0 |
chromiumAlpine:v3.23 |
before 89.0.4389.90-r0 | 89.0.4389.90-r0 |
Show 24 moreShow less
| Package | Affected | Fixed |
|---|---|---|
chromiumAlpine:v3.24 |
before 89.0.4389.90-r0 | 89.0.4389.90-r0 |
qt5-qtwebengineAlpine:v3.14 |
before 5.15.3_git20200401-r0 | 5.15.3_git20200401-r0 |
qt5-qtwebengineAlpine:v3.15 |
before 5.15.3_git20200401-r0 | 5.15.3_git20200401-r0 |
qt5-qtwebengineAlpine:v3.16 |
before 5.15.3_git20200401-r0 | 5.15.3_git20200401-r0 |
qt5-qtwebengineAlpine:v3.17 |
before 5.15.3_git20200401-r0 | 5.15.3_git20200401-r0 |
qt5-qtwebengineAlpine:v3.18 |
before 5.15.3_git20200401-r0 | 5.15.3_git20200401-r0 |
qt5-qtwebengineAlpine:v3.19 |
before 5.15.3_git20200401-r0 | 5.15.3_git20200401-r0 |
qt5-qtwebengineAlpine:v3.20 |
before 5.15.3_git20200401-r0 | 5.15.3_git20200401-r0 |
qt5-qtwebengineAlpine:v3.21 |
before 5.15.3_git20200401-r0 | 5.15.3_git20200401-r0 |
qt5-qtwebengineAlpine:v3.22 |
before 5.15.3_git20200401-r0 | 5.15.3_git20200401-r0 |
qt5-qtwebengineAlpine:v3.23 |
before 5.15.3_git20200401-r0 | 5.15.3_git20200401-r0 |
chromiumDebian:12 |
before 89.0.4389.90-1 | 89.0.4389.90-1 |
chromiumDebian:13 |
before 89.0.4389.90-1 | 89.0.4389.90-1 |
chromiumDebian:14 |
before 89.0.4389.90-1 | 89.0.4389.90-1 |
chromiumDebian:10 From an advisory covering 41 CVEs |
before 89.0.4389.114-1~deb10u1, plus listed versions 73.0.3683.75-174.0.3729.108-175.0.3770.10-175.0.3770.80-175.0.3770.90-1 Show 45 moreShow less76.0.3809.100-176.0.3809.100-1~deb10u176.0.3809.62-176.0.3809.71-176.0.3809.87-176.0.3809.87-278.0.3904.108-178.0.3904.108-1~deb10u178.0.3904.87-178.0.3904.97-178.0.3904.97-1~deb10u179.0.3945.130-179.0.3945.130-1~deb10u179.0.3945.130-279.0.3945.56-179.0.3945.79-180.0.3987.106-180.0.3987.116-180.0.3987.122-180.0.3987.122-280.0.3987.132-180.0.3987.132-1~deb10u180.0.3987.149-180.0.3987.149-1~deb10u180.0.3987.162-180.0.3987.162-1~deb10u181.0.4044.62-181.0.4044.92-183.0.4103.106-183.0.4103.116-183.0.4103.116-1~deb10u183.0.4103.116-1~deb10u283.0.4103.116-1~deb10u383.0.4103.116-283.0.4103.116-383.0.4103.116-3.183.0.4103.83-184.0.4147.105-184.0.4147.89-187.0.4280.141-0.187.0.4280.141-0.1~deb10u187.0.4280.88-0.187.0.4280.88-0.287.0.4280.88-0.387.0.4280.88-0.4 |
89.0.4389.114-1~deb10u1 |
chromium-browser-stableMageia:7 From an advisory covering 36 CVEs |
before 89.0.4389.90-1.mga7 | 89.0.4389.90-1.mga7 |
chromium-browser-stableMageia:8 From an advisory covering 36 CVEs |
before 89.0.4389.90-1.mga8 | 89.0.4389.90-1.mga8 |
chromium-browserUbuntu:16.04:LTS |
before 89.0.4389.82-0ubuntu0.16.04.1, plus listed versions 45.0.2454.101-0ubuntu1.120147.0.2526.73-0ubuntu1.121847.0.2526.106-0ubuntu1.122148.0.2564.82-0ubuntu1.122248.0.2564.116-0ubuntu1.1229 Show 45 moreShow less49.0.2623.87-0ubuntu1.123249.0.2623.108-0ubuntu1.123350.0.2661.102-0ubuntu0.16.04.1.123751.0.2704.79-0ubuntu0.16.04.1.124252.0.2743.116-0ubuntu0.16.04.1.125053.0.2785.143-0ubuntu0.16.04.1.125453.0.2785.143-0ubuntu0.16.04.1.125755.0.2883.87-0ubuntu0.16.04.126356.0.2924.76-0ubuntu0.16.04.126857.0.2987.98-0ubuntu0.16.04.127658.0.3029.81-0ubuntu0.16.04.127758.0.3029.96-0ubuntu0.16.04.127958.0.3029.110-0ubuntu0.16.04.128159.0.3071.109-0ubuntu0.16.04.128959.0.3071.109-0ubuntu0.16.04.129160.0.3112.78-0ubuntu0.16.04.129360.0.3112.113-0ubuntu0.16.04.129861.0.3163.79-0ubuntu0.16.04.130061.0.3163.100-0ubuntu0.16.04.130662.0.3202.62-0ubuntu0.16.04.130862.0.3202.75-0ubuntu0.16.04.131362.0.3202.89-0ubuntu0.16.04.131562.0.3202.94-0ubuntu0.16.04.131763.0.3239.84-0ubuntu0.16.04.163.0.3239.132-0ubuntu0.16.04.164.0.3282.119-0ubuntu0.16.04.164.0.3282.140-0ubuntu0.16.04.164.0.3282.167-0ubuntu0.16.04.165.0.3325.181-0ubuntu0.16.04.166.0.3359.139-0ubuntu0.16.04.366.0.3359.181-0ubuntu0.16.04.167.0.3396.99-0ubuntu0.16.04.268.0.3440.75-0ubuntu0.16.04.168.0.3440.106-0ubuntu0.16.04.169.0.3497.81-0ubuntu0.16.04.170.0.3538.67-0ubuntu0.16.04.170.0.3538.77-0ubuntu0.16.04.170.0.3538.110-0ubuntu0.16.04.171.0.3578.80-0ubuntu0.16.04.171.0.3578.98-0ubuntu0.16.04.172.0.3626.119-0ubuntu0.16.04.172.0.3626.121-0ubuntu0.16.04.173.0.3683.75-0ubuntu0.16.04.173.0.3683.86-0ubuntu0.16.04.174.0.3729.169-0ubuntu0.16.04.1 |
89.0.4389.82-0ubuntu0.16.04.1 |
chromium-browserUbuntu:18.04:LTS |
before 89.0.4389.82-0ubuntu0.18.04.1, plus listed versions 61.0.3163.100-0ubuntu1.137862.0.3202.62-0ubuntu0.17.10.138062.0.3202.89-0ubuntu1.138662.0.3202.94-0ubuntu1.138863.0.3239.84-0ubuntu1 Show 44 moreShow less63.0.3239.108-0ubuntu164.0.3282.119-0ubuntu164.0.3282.140-0ubuntu164.0.3282.167-0ubuntu165.0.3325.146-0ubuntu165.0.3325.181-0ubuntu166.0.3359.139-0ubuntu0.18.04.366.0.3359.181-0ubuntu0.18.04.167.0.3396.99-0ubuntu0.18.04.168.0.3440.75-0ubuntu0.18.04.168.0.3440.106-0ubuntu0.18.04.169.0.3497.81-0ubuntu0.18.04.170.0.3538.67-0ubuntu0.18.04.170.0.3538.77-0ubuntu0.18.04.170.0.3538.110-0ubuntu0.18.04.171.0.3578.80-0ubuntu0.18.04.171.0.3578.98-0ubuntu0.18.04.172.0.3626.119-0ubuntu0.18.04.172.0.3626.121-0ubuntu0.18.04.173.0.3683.75-0ubuntu0.18.04.173.0.3683.86-0ubuntu0.18.04.174.0.3729.169-0ubuntu0.18.04.175.0.3770.90-0ubuntu0.18.04.175.0.3770.142-0ubuntu0.18.04.176.0.3809.87-0ubuntu0.18.04.176.0.3809.100-0ubuntu0.18.04.177.0.3865.90-0ubuntu0.18.04.178.0.3904.70-0ubuntu0.18.04.278.0.3904.97-0ubuntu0.18.04.178.0.3904.108-0ubuntu0.18.04.179.0.3945.79-0ubuntu0.18.04.179.0.3945.130-0ubuntu0.18.04.180.0.3987.87-0ubuntu0.18.04.180.0.3987.149-0ubuntu0.18.04.180.0.3987.163-0ubuntu0.18.04.181.0.4044.122-0ubuntu0.18.04.181.0.4044.138-0ubuntu0.18.04.183.0.4103.61-0ubuntu0.18.04.184.0.4147.105-0ubuntu0.18.04.185.0.4183.83-0ubuntu0.18.04.285.0.4183.121-0ubuntu0.18.04.186.0.4240.75-0ubuntu0.18.04.186.0.4240.198-0ubuntu0.18.04.187.0.4280.66-0ubuntu0.18.04.1 |
89.0.4389.82-0ubuntu0.18.04.1 |
chromiumopenSUSE:Leap 15.2 From an advisory covering 3 CVEs |
before 89.0.4389.90-lp152.2.80.1 | 89.0.4389.90-lp152.2.80.1 |
chromiumSUSE:Package Hub 15 SP2 From an advisory covering 3 CVEs |
before 89.0.4389.90-bp152.2.65.1 | 89.0.4389.90-bp152.2.65.1 |
operaopenSUSE:Leap 15.2 NonFree From an advisory covering 9 CVEs |
before 75.0.3969.171-lp152.2.40.1 | 75.0.3969.171-lp152.2.40.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 1081 CVEs |
before 93.0.4577.82-1.1 | 93.0.4577.82-1.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 2310 CVEs |
before 113.0.5672.92-1.1 | 113.0.5672.92-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | mehrzad1994/CVE-2021-21193 | 2022-03-28 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| exploitation | ||
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-21193 is a high vulnerability (CVSS 8.8) in Google Chrome, published March 16, 2021. CISA lists it as known to be exploited, since November 3, 2021. EUVD reports exploitation since November 3, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.95%, the 95th percentile. Fixed in chromium 89.0.4389.90-r0.
References
chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop_12.html
crbug.com/1186287
debian.org/security/2021/dsa-4886
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N52OWF4BAP3JNK2QYGU3Q6QUVDZDCIMQ
security.gentoo.org/glsa/202104-08
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21193
Show 194 moreShow less
nvd.nist.gov/vuln/detail/CVE-2021-21193
github.com/advisories/GHSA-hf6r-r2hj-f2g7
security.alpinelinux.org/vuln/CVE-2021-21193
security-tracker.debian.org/tracker/CVE-2021-21193
advisories.mageia.org/MGASA-2021-0142.html
bugs.mageia.org/show_bug.cgi?id=28534
ubuntu.com/security/CVE-2021-21193
cve.org/CVERecord?id=CVE-2021-21193
lists.opensuse.org/archives/list/[email protected]/thread/KJEA6IOQ2CJDQ5EOOYOTAMEHN6772YOW
bugzilla.suse.com/1183515
suse.com/security/cve/CVE-2021-21191
This page doesn't list everything
Left out here: 30 versions and 2,133 references. The JSON record has them.