CVE-2021-21224: Type Confusion in V8
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Other sources
Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 90.0.4430.212-1~deb10u1Fixed in 116.0.5845.180-1~deb11u1Fixed in 118.0.5993.70-1~deb11u1Fixed in 116.0.5845.180-1~deb12u1Fixed in 118.0.5993.70-1~deb12u1Fixed in 118.0.5993.70-1 - Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 90.0.4430.85
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2021-21224?
CVE-2021-21224 is a type confusion vulnerability in Google Chromium V8 Engine that allows remote code execution.
Which software is affected by CVE-2021-21224?
Software affected by CVE-2021-21224 includes web browsers that utilize Chromium, such as Google Chrome and Microsoft Edge, as well as Debian Linux and Fedoraproject Fedora.
How severe is CVE-2021-21224?
CVE-2021-21224 has a severity rating of 8.8, which is considered high.
How can CVE-2021-21224 be fixed?
To fix CVE-2021-21224, it is recommended to update to the latest versions of affected software, such as Google Chrome version 90.0.4430.212, Debian Chromium version 90.0.4430.212-1~deb10u1, and Fedoraproject Chromium version 118.0.5993.70-1.
Where can I find more information about CVE-2021-21224?
For more information about CVE-2021-21224, you can refer to the following references: [1] [2] [3]