Google Chromium Blink Use-After-Free Vulnerability
Google · Chromium Blink
A use-after-free flaw in the Blink rendering component of Google Chromium (Chrome releases prior to 89.0.4389.128) can lead to heap corruption. A remote attacker can trigger it by getting a user to open a crafted HTML page, which requires no authentication but does require user interaction.
Use after free in Blink in Google Chrome prior to 89.0.4389.128 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Exploited
- Yes, in CISA KEV
- Reports
- 0
- Tactics
- 1/15
How an attack unfolds
Based on MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. mappings. Select a step to see the evidence.Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 19 days before it was disclosed.
- First seen exploitedVulnCheck KEV evidence19 days before
- Disclosedday 0
- Added to CISA KEVEU database agrees+6 mo
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
2 TechniqueOne specific attacker behaviour in MITRE ATT&CK, such as T1190 “Exploit Public-Facing Application”. IDs with a dot, like T1059.004, are sub-techniques., grouped by TacticThe attacker’s goal at a stage of an attack in MITRE ATT&CK, such as Initial Access or Persistence. Each technique belongs to one or more tactics. in kill-chain order 2ExecutionTA0002
CVE-2021-21206 allows an adversary to use JavaScript to exploit the Blink rendering engine of the Chromium Browser that allows for execution of arbitrary code.
Detection
0 rules for this CVE · 64 general rules for its techniquesRules for this CVE
0Sigma ruleAn open, vendor-neutral detection rule for log data. Security teams convert Sigma rules into searches for their own SIEM. that reference CVE-2021-21206 directly.CVE-specific rules are not available in this build. Search SigmaHQ ↗
General rules for this CVE’s techniques
These detect the technique in general, not this specific vulnerability.
JavaScriptT1059.00729 general rules
- Adwind RAT / JRAThightest
- Adwind RAT / JRAT File Artifacthightest
- Csc.EXE Execution Form Potentially Suspicious Parenthightest
- Cscript/Wscript Uncommon Script Extension Executionhightest
- HackTool - CACTUSTORCH Remote Thread Creationhightest
- HackTool - Koadic Executionhightest
- HTML Help HH.EXE Suspicious Child Processhightest
- JXA In-memory Execution Via OSAScripthightest
Exploitation for Client ExecutionT120335 general rules
- Antivirus - Exploitation Framework Signaturecriticalstable
- Droppers Exploiting CVE-2017-11882criticalstable
- Audit CVE Eventcriticaltest
- CVE-2021-31979 CVE-2021-33771 Exploitscriticaltest
- CVE-2021-31979 CVE-2021-33771 Exploits by Sourgumcriticaltest
- Exploit for CVE-2017-8759criticaltest
- Antivirus - APT Malware Signaturecriticalexperimental
- Antivirus - Remote Access Tools Signaturecriticalexperimental
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
What security researchers reported
Not named in any threat report yetAlso mentioned in 50 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Actively_Exploited_Kev | Oct 29, 202628 Oct 2026
- Actively_Exploited_Kev | Oct 28, 202627 Oct 2026
- Actively_Exploited_Kev | Oct 27, 202626 Oct 2026
- Actively_Exploited_Kev | Oct 24, 202623 Oct 2026
- Actively_Exploited_Kev | Oct 23, 202622 Oct 2026
- Actively_Exploited_Kev | Oct 22, 202621 Oct 2026
- 44 more on OTX