CVE-2021-4100: Object lifecycle issue in ANGLE

Q: What is the severity of CVE-2021-4100?

CVE-2021-4100 is considered a high severity vulnerability due to its potential for remote code execution through heap corruption.

Q: How do I fix CVE-2021-4100?

To fix CVE-2021-4100, users should update Google Chrome to version 96.0.4664.110 or later.

Q: Which versions are affected by CVE-2021-4100?

CVE-2021-4100 affects versions of Google Chrome before 96.0.4664.110.

Q: Can CVE-2021-4100 be exploited by a remote attacker?

Yes, CVE-2021-4100 can be exploited by a remote attacker via a specially crafted HTML page.

Q: What component of Google Chrome does CVE-2021-4100 affect?

CVE-2021-4100 affects the ANGLE component of Google Chrome.

Published Nov 19, 2021

Updated

Object lifecycle issue in ANGLE in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Credit

Aki Helin(Solita)

Affected Software

3 affected componentsFixes available

Google Chrome<96.0.4664.110

96.0.4664.110

Google Chrome<96.0.4664.110

debian/chromium

150.0.7871.100-1~deb12u1156.0.8078.79-1~deb12u1150.0.7871.181-1~deb13u1156.0.8078.79-1~deb13u1156.0.8078.79-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Google Chrome (Trace Event) to a version that resolves this vulnerability.
Fixed in 96.0.4664.110
Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1

Event History

Nov 19, 2021

CVE Published

12:00 AM

Feb 11, 2022

CVE Published

via MITRE·10:55 PM

Data Sourced

via MITRE·10:55 PM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2021-4100?