CVE-2021-4102: Google Chrome V8 use-after-free enables heap corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a remotely reachable, high-CVSS memory-corruption flaw with confirmed exploitation in the wild per CISA KEV, though it requires user interaction and a patch has long been available.

What it is

Chrome's V8 JavaScript engine contains a use-after-free flaw (CWE-416) that a remote attacker can trigger with a crafted HTML page, leading to heap corruption. It affects Chrome versions prior to 96.0.4664.110 and was serious enough to be added to CISA's Known Exploited Vulnerabilities catalog.

Impact

Successful exploitation can corrupt the heap and, per the CVSS vector, yields high impact to confidentiality, integrity and availability, giving the attacker a path to code execution in the browser process.

Attack surface

Reached over the network by rendering a crafted HTML page; no privileges are required but the victim must interact, typically by visiting the page or opening the content.

Exploitation

Listed in CISA KEV with a 2021-12-15 addition and 2021-12-29 remediation due date, indicating known exploitation in the wild; EPSS 30-day probability is 0.07836 (94th percentile). No ransomware campaign use is documented.

What to do

• Update Chrome to 96.0.4664.110 or later, and apply the vendor's stable channel update; prioritize this per the KEV due date.
• Track Chromium-based browsers and embedded Chromium components separately, since they may lag the Chrome fix.
• Enforce automatic browser updates and verify version compliance across endpoints.
• Restrict or isolate high-risk browsing and block known malicious sites where feasible.

Detection

• Monitor for Chrome processes spawning unexpected child processes or writing executables, consistent with browser exploitation.
• Alert on crashes or renderer instability in chrome.exe tied to V8, especially clustered after visits to untrusted pages.
• Hunt proxy and DNS logs for known exploit-hosting or malvertising domains delivering crafted HTML.
• Check endpoint inventories for Chrome versions below 96.0.4664.110.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.