CVE-2021-21166: Object lifecycle issue in audio
Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Other sources
Google Chromium contains a race condition vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
— CISA
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 90.0.4430.212-1~deb10u1Fixed in 116.0.5845.180-1~deb11u1Fixed in 118.0.5993.70-1~deb11u1Fixed in 116.0.5845.180-1~deb12u1Fixed in 118.0.5993.70-1~deb12u1Fixed in 118.0.5993.70-1 - Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 89.0.4389.72
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
- CVE-2021-21159
- CVE-2021-21160
- CVE-2021-21161
- CVE-2021-21162
- CVE-2021-21163
- CVE-2021-21164
- CVE-2021-21165
- CVE-2021-21167
- CVE-2021-21168
- CVE-2021-21169
- CVE-2021-21170
- CVE-2021-21171
- CVE-2021-21172
- CVE-2021-21173
- CVE-2021-21174
- CVE-2021-21175
- CVE-2021-21176
- CVE-2021-21177
- CVE-2021-21178
- CVE-2021-21179
- CVE-2021-21180
- CVE-2020-27844
- CVE-2021-21181
- CVE-2021-21182
- CVE-2021-21183
- CVE-2021-21184
- CVE-2021-21185
- CVE-2021-21186
- CVE-2021-21187
- CVE-2021-21188
- CVE-2021-21189
- CVE-2021-21190
- CVE-2021-21200
Frequently Asked Questions
What is CVE-2021-21166?
CVE-2021-21166 is a race condition vulnerability in audio in Google Chromium.
How does CVE-2021-21166 affect web browsers?
CVE-2021-21166 affects web browsers that utilize Chromium, including Google Chrome and Microsoft Edge.
What is the severity of CVE-2021-21166?
CVE-2021-21166 has a severity rating of 8.8 out of 10 (high severity).
How can a remote attacker exploit CVE-2021-21166?
A remote attacker can potentially exploit CVE-2021-21166 by using a crafted HTML page to trigger heap corruption.
How can I fix CVE-2021-21166 in Chromium web browsers?
To fix CVE-2021-21166, update your Chromium web browsers to the recommended versions provided by the vendor.