CVE-2021-21193: Google Chrome Blink use-after-free via crafted HTML page

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is remotely reachable, rated CVSS 8.8, and listed in CISA KEV as exploited in the wild, though it requires user interaction.

What it is

Google Chrome before 89.0.4389.90 contains a use-after-free flaw in the Blink rendering engine. A remote attacker can trigger heap corruption by getting a victim to open a crafted HTML page, which can lead to code execution in the browser process context.

Impact

An attacker who successfully exploits the heap corruption can potentially execute arbitrary code with the privileges of the browser, affecting confidentiality, integrity and availability.

Attack surface

The flaw is reached over the network through a crafted HTML page rendered by Chrome's Blink engine. No authentication is required, but the CVSS vector indicates user interaction is required, meaning the victim must open or view the malicious page.

Exploitation

The vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating exploitation in the wild, and EPSS gives it a 30-day probability of about 9.9 percent (95th percentile). No ransomware campaign use is documented.

What to do

• Update Google Chrome to version 89.0.4389.90 or later as directed by the vendor release notes.
• Apply the corresponding Fedora, Debian and Gentoo package updates for Chromium-based browsers.
• Enforce automatic browser updates and verify version compliance across endpoints.
• Restrict or sandbox browsing of untrusted web content where feasible.
• Monitor CISA KEV guidance and apply updates within the required remediation window.

Detection

• Monitor for Chrome or Chromium crashes and renderer process terminations that may indicate heap corruption attempts.
• Review proxy and DNS logs for access to known malicious or suspicious HTML pages tied to exploitation campaigns.
• Track endpoint process behavior for unusual child processes or code execution originating from the browser.
• Check installed browser versions against the fixed 89.0.4389.90 baseline to identify unpatched hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.