CVE-2021-4100 Memory corruption in Chrome

High 8.8 Published 11 Feb 2022 Updated 3 Aug 2024

Remote attackers can exploit heap corruption in ANGLE via crafted HTML pages, potentially leading to code execution in Google Chrome.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2021-4100?

CVE-2021-4100 is a high-severity memory corruption vulnerability in Google Chrome, published on 11 Feb 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Object lifecycle issue in ANGLE in Google Chrome prior to 96.0.4664.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Weakness: CWE-787, CWE-125

Which versions are affected by CVE-2021-4100?

It affects 1 product.

Products include Google Chrome.

How do I fix CVE-2021-4100?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2021-4100 being exploited?

There is no known exploitation of CVE-2021-4100 in the wild and no public exploit code.

All Google Chrome vulnerabilities

Sources

Also known as DEBIAN-CVE-2021-4100, GHSA-pjg5-4frx-8m6r, UBUNTU-CVE-2021-4100.