Vulnerability record · CVE-2021-21224 · published 26 April 2021
CVE-2021-21224: Google Chrome V8 type confusion allows sandboxed code execution
Google · Chrome
Google Chrome before 90.0.4430.85 contains a type confusion flaw in the V8 JavaScript engine. A crafted HTML page can trigger the confusion and let a remote attacker execute arbitrary code inside the browser sandbox. The issue is confirmed as exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Description
Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
critical priorityIt is a remotely reachable, high-impact type confusion in a widely deployed browser that is confirmed exploited in the wild and listed in CISA KEV.
What it is
Google Chrome before 90.0.4430.85 contains a type confusion flaw in the V8 JavaScript engine. A crafted HTML page can trigger the confusion and let a remote attacker execute arbitrary code inside the browser sandbox. The issue is confirmed as exploited in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Impact
An attacker can execute arbitrary code within the Chrome sandbox, potentially leading to full compromise of the browser process and the data it handles. The CVSS vector shows high confidentiality, integrity and availability impact.
Attack surface
Reached over the network by luring a user to a crafted HTML page; no authentication is required but user interaction (visiting the page) is needed per the CVSS vector AV:N/AC:L/PR:N/UI:R.
Exploitation
CISA KEV lists it as known exploited with a 2021-11-17 remediation due date, and EPSS shows a 30-day probability of 0.84173 (99.68th percentile). A reference is tagged Exploit, confirming public exploit information exists.
What to do
- Update Google Chrome to 90.0.4430.85 or later immediately.
- Apply the corresponding Debian and Fedora package updates for Chromium/Chrome.
- Enforce automatic browser updates and verify version compliance across endpoints.
- Restrict or block untrusted web content and consider browser isolation for high-risk users.
- Monitor CISA KEV guidance and apply vendor instructions by the due date.
Detection
- Hunt for Chrome/Chromium versions below 90.0.4430.85 in asset inventories.
- Monitor for crashes or abnormal behavior in the V8 renderer process.
- Review web proxy or DNS logs for access to known exploit-hosting domains.
- Correlate endpoint telemetry for suspicious child processes spawned by the browser.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2021-21224 to the Known Exploited Vulnerabilities catalog on 3 November 2021 as "Google Chromium V8 Type Confusion Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 17 November 2021.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2021-21224 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-21224), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
