CVE DatabaseCVE-2021-4102

Updated 2026-06-17한국어 권고문 →

CVE-2021-41028.8/HIGHCISA KEVCWE-416CWE-416

Google Chrome V8 Engine Use-After-Free Vulnerability (CVE-2021-4102) Technical Advisory

⚡ Jump to Patch

Affected Vendors

google

Affected Components

chrome

Published Date

2022-02-11

CVSS v3.1

8.8

HIGH

EPSS (30d)

7.8%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Google Chrome prior to version 96.0.4664.110

Impact

A remote attacker can exploit heap corruption via a crafted HTML page to potentially execute arbitrary code

Mitigation

Immediately update Google Chrome to version 96.0.4664.110 or later

Affected Products & Version Scope

Google Chrome prior to 96.0.4664.110 (All Desktop Platforms)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

To mitigate this vulnerability, upgrade Google Chrome to the latest stable channel version on all affected endpoints.

bash

# Update Google Chrome on Debian/Ubuntu-based systems
sudo apt-get update && sudo apt-get --only-upgrade install google-chrome-stable -y

# Update Google Chrome on RedHat/CentOS-based systems
sudo yum update google-chrome-stable -y

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, restrict access to untrusted external websites and ensure that Chrome's security features, such as the sandbox, are strictly enforced.

bash

# Ensure Chrome is not running with the '--no-sandbox' flag in enterprise environments
ps aux | grep chrome | grep -E '--no-sandbox'

3. Log Audit & IoC Verification Commands

Use the following script to audit the installed version of Google Chrome on Linux endpoints and verify if it is vulnerable.

bash

# Bash script to check Google Chrome version compliance
current_ver=$(google-chrome --version | awk '{print $3}')
safe_ver='96.0.4664.110'

if [ '$(printf '%s\
%s' '$safe_ver' '$current_ver' | sort -V | head -n1)' != '$safe_ver' ]; then
  echo '[WARNING] Vulnerable Chrome version detected: '$current_ver'. Upgrade required.'
else
  echo '[OK] Chrome version is secure: '$current_ver'
fi

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

SentinelOne Singularity AI EDR

Due to active exploitation in the wild, immediately upgrade Google Chrome to version 96.0.4664.110 or higher across all enterprise endpoints.

Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot

Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.

100% MITRE ATT&CK Detection · 1-Click Rollback

See Autonomous Endpoint Protection in Action

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2021-4102) is a Use-After-Free (UAF) flaw in the V8 JavaScript and WebAssembly engine of Google Chrome. It occurs when the V8 engine fails to properly manage the lifecycle of memory objects, allowing a program to reference a memory location after it has been deallocated. This leads to heap corruption and memory layout manipulation.

2. Exploitation Mechanics & Attack Scenario

An attacker can exploit this vulnerability by hosting a specially crafted HTML page containing malicious JavaScript. When a victim visits the page, the script triggers a sequence that deallocates a specific object while keeping a dangling pointer active. By leveraging techniques like heap spraying, the attacker fills the freed memory space with controlled payloads. When V8 attempts to reuse the object, it executes the attacker-controlled data, leading to arbitrary code execution within the browser's renderer process sandbox.

3. Infrastructure & Business Impact

As a vulnerability listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, CVE-2021-4102 has been actively exploited in the wild. Successful exploitation can compromise the integrity of the user's workstation. If combined with a secondary sandbox escape or local privilege escalation (LPE) vulnerability, it could grant the attacker full administrative access to the host operating system, posing a severe threat to corporate networks and sensitive data.

Official Vendor Advisories & References

NVD Original English Description

Use after free in V8 in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop_13.html

Source: chrome-cve-admin@google.com · Release Notes, Vendor Advisory

https://crbug.com/1278387

Source: chrome-cve-admin@google.com · Third Party Advisory

https://chromereleases.googleblog.com/2021/12/stable-channel-update-for-desktop_13.html

Source: af854a3a-2127-422b-91ae-364da2661108 · Release Notes, Vendor Advisory

https://crbug.com/1278387

Source: af854a3a-2127-422b-91ae-364da2661108 · Third Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-4102

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2021-4102)

FAQ

Q1. How critical is CVE-2021-4102 and is it actively exploited in the wild?

CVE-2021-4102 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 7.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2021-4102?

Primary impacted vendors include google across chrome. Scope summary: Google Chrome prior to 96.0.4664.110 (All Desktop Platforms)

Q3. What temporary mitigations or workarounds exist for CVE-2021-4102 before patching?

[Mitigation] Immediately update Google Chrome to version 96.0.4664.110 or later Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION