Search for vulnerabilities
Vulnerability details: VCID-agbp-n1nt-cyc6
Vulnerability ID VCID-agbp-n1nt-cyc6
Aliases CVE-2021-21224
Summary Type confusion in V8 in Google Chrome prior to 90.0.4430.85 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Status Published
Exploitability 2.0
Weighted Severity 8.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
System Score Found at
epss 0.54382 https://api.first.org/data/v1/epss?cve=CVE-2021-21224
epss 0.65436 https://api.first.org/data/v1/epss?cve=CVE-2021-21224
epss 0.65436 https://api.first.org/data/v1/epss?cve=CVE-2021-21224
epss 0.65436 https://api.first.org/data/v1/epss?cve=CVE-2021-21224
epss 0.65436 https://api.first.org/data/v1/epss?cve=CVE-2021-21224
epss 0.65436 https://api.first.org/data/v1/epss?cve=CVE-2021-21224
epss 0.65436 https://api.first.org/data/v1/epss?cve=CVE-2021-21224
epss 0.65954 https://api.first.org/data/v1/epss?cve=CVE-2021-21224
epss 0.65954 https://api.first.org/data/v1/epss?cve=CVE-2021-21224
epss 0.66739 https://api.first.org/data/v1/epss?cve=CVE-2021-21224
epss 0.66739 https://api.first.org/data/v1/epss?cve=CVE-2021-21224
epss 0.66739 https://api.first.org/data/v1/epss?cve=CVE-2021-21224
epss 0.66739 https://api.first.org/data/v1/epss?cve=CVE-2021-21224
epss 0.66739 https://api.first.org/data/v1/epss?cve=CVE-2021-21224
epss 0.66739 https://api.first.org/data/v1/epss?cve=CVE-2021-21224
epss 0.66739 https://api.first.org/data/v1/epss?cve=CVE-2021-21224
epss 0.66739 https://api.first.org/data/v1/epss?cve=CVE-2021-21224
epss 0.66739 https://api.first.org/data/v1/epss?cve=CVE-2021-21224
epss 0.66739 https://api.first.org/data/v1/epss?cve=CVE-2021-21224
epss 0.66739 https://api.first.org/data/v1/epss?cve=CVE-2021-21224
cvssv3.1 8.8 https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_20.html
ssvc Attend https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_20.html
cvssv3.1 8.8 https://crbug.com/1195777
ssvc Attend https://crbug.com/1195777
cvssv3.1 8.8 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
ssvc Attend https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
cvssv3.1 8.8 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/
ssvc Attend https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/
cvssv3.1 8.8 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/
ssvc Attend https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/
cvssv2 6.8 https://nvd.nist.gov/vuln/detail/CVE-2021-21224
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2021-21224
archlinux High https://security.archlinux.org/AVG-1843
archlinux High https://security.archlinux.org/AVG-1858
cvssv3.1 8.8 https://security.gentoo.org/glsa/202104-08
ssvc Attend https://security.gentoo.org/glsa/202104-08
cvssv3.1 8.8 https://www.debian.org/security/2021/dsa-4906
ssvc Attend https://www.debian.org/security/2021/dsa-4906
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2021-21224
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21201
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21202
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21203
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21204
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21205
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21207
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21208
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21209
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21210
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21211
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21212
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21213
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21214
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21215
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21216
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21217
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21218
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21219
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21221
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21222
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21223
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21224
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21225
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21226
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-4323
1195777 https://crbug.com/1195777
202104-08 https://security.gentoo.org/glsa/202104-08
987358 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=987358
ASA-202104-7 https://security.archlinux.org/ASA-202104-7
AVG-1843 https://security.archlinux.org/AVG-1843
AVG-1858 https://security.archlinux.org/AVG-1858
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
CVE-2021-21224 https://nvd.nist.gov/vuln/detail/CVE-2021-21224
dsa-4906 https://www.debian.org/security/2021/dsa-4906
EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
stable-channel-update-for-desktop_20.html https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_20.html
U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/
VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/
Data source KEV
Date added Nov. 3, 2021
Description Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action Apply updates per vendor instructions.
Due date Nov. 17, 2021
Note 
https://nvd.nist.gov/vuln/detail/CVE-2021-21224
Ransomware campaign use Unknown
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_20.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T16:53:31Z/ Found at https://chromereleases.googleblog.com/2021/04/stable-channel-update-for-desktop_20.html
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://crbug.com/1195777
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T16:53:31Z/ Found at https://crbug.com/1195777
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T16:53:31Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EAJ42L4JFPBJATCZ7MOZQTUDGV4OEHHG/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T16:53:31Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U3GZ42MYPGD35V652ZPVPYYS7A7LVXVY/
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T16:53:31Z/ Found at https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VUZBGKGVZADNA3I24NVG7HAYYUTOSN5A/
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2021-21224
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-21224
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://security.gentoo.org/glsa/202104-08
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T16:53:31Z/ Found at https://security.gentoo.org/glsa/202104-08
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.debian.org/security/2021/dsa-4906
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-01-29T16:53:31Z/ Found at https://www.debian.org/security/2021/dsa-4906
Exploit Prediction Scoring System (EPSS)
Percentile 0.97952
EPSS Score 0.54382
Published At Sept. 25, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T09:46:52.425938+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2021/21xxx/CVE-2021-21224.json 37.0.0