CVE-2021-21157

Published: Feb 22, 2021Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

Use after free in Web Sockets in Google Chrome on Linux prior to 88.0.4324.182 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Affected (5)

Products: Microsoft: Edge, Edge Chromium · Fedoraproject: Fedora · Google: Chrome

2 products

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Microsoft Edge	Before 88.0.705.74
Microsoft Edge Chromium	Before 88.0.4324.182

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 32
Fedoraproject Fedora	Version 33

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Google Chrome	Before 88.0.4324.182

Running on/with	Platform Versions
Linux Linux Kernel	All versions

Related CWEs

CWE-416

Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.