CVE-2021-21166
Google Chromium Race Condition Vulnerability
Description
CVE-2021-21166 is a HIGH-severity race condition vulnerability in Google Chromium's audio component, carrying a CVSS 3.1 score of 8.8. A data race in the audio processing subsystem of Google Chrome prior to version 89.0.4389.72 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability affects multiple Chromium-based browsers including Google Chrome, Microsoft Edge, and Opera. This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2021-11-17. With an EPSS score of 0.36262 (97.04th percentile), this vulnerability demonstrates very high real-world exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 89.0.4389.72 | |
| fedoraproject | fedora | 32; 33; 34 |
| debian | debian linux | 10.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://chromereleases.googleblog.com/2021/03/stable-channel-update-for-desktop.html(Release Notes)
- https://crbug.com/1177465(Permissions Required)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BBT54RKAE5XLMWSHLVUKJ7T2XHHYMXLH/(Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FE5SIKEVYTMDCC5OSXGOM2KRPYLHYMQX/(Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LCIDZ77XUDMB2EBPPWCQXPEIJERDNSNT/(Release Notes)
- https://security.gentoo.org/glsa/202104-08(Third Party Advisory)
- https://www.debian.org/security/2021/dsa-4886(Mailing List, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-21166(US Government Resource)
Weakness Type
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVE-2021-21166 is classified under CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'). Race condition vulnerabilities occur when multiple threads, processes, or systems access and modify shared resources concurrently without proper synchronization, causing the outcome to depend on the timing of operations.
In the context of Chromium's audio component, the data race occurs when concurrent audio processing threads access shared memory without adequate synchronization. This timing-dependent bug can corrupt heap structures, leading to a use-after-free or buffer overflow condition that attackers can exploit for code execution. Browser audio components are particularly susceptible to race conditions due to the real-time nature of audio processing, which often involves multiple threads operating on shared audio buffers.
Learn more: CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization
Impact Analysis
CVE-2021-21166 carries a CVSS 3.1 score of 8.8 (HIGH) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation through heap corruption can grant the attacker access to sensitive data within the browser process, including browsing history, stored credentials, cookies, and session tokens.
Integrity (HIGH): The heap corruption enables arbitrary code execution within the Chrome renderer process, allowing the attacker to modify browser state, inject malicious content, or use the compromised process as a stepping stone for further attacks.
Availability (HIGH): Complete disruption of the browser process is possible through heap corruption, ranging from browser crashes to persistent compromise of the browsing session.
Scope Unchanged: The vulnerability's impact is contained within the Chromium browser component. While the renderer process may be compromised, the sandbox provides a boundary that limits direct system-level impact without an additional sandbox escape vulnerability.
With an EPSS score of 0.36262 (97.04th percentile), this vulnerability ranks among the most likely to be exploited, reflecting confirmed in-the-wild exploitation.
Exploit Maturity
CVE-2021-21166 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: Google confirmed that this vulnerability was being actively exploited in the wild at the time of discovery. The Chrome 89 stable release in March 2021 specifically noted that CVE-2021-21166 had known exploitation. This was one of several Chrome zero-days discovered in early 2021.
Ransomware association: No direct ransomware association has been confirmed for CVE-2021-21166. The browser-based nature of this vulnerability suggests use in targeted attacks, watering hole operations, or as part of exploit kits rather than in direct ransomware deployment.
Attack surface: As a Chromium-level vulnerability, this affects not only Google Chrome but also other Chromium-based browsers such as Microsoft Edge, Opera, and Brave. The broad adoption of Chromium means the potential attack surface spans billions of browser installations worldwide.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2021-11-17. All organizations should ensure Chromium-based browsers are updated to version 89.0.4389.72 or later.
Remediation
- Update all Chromium-based browsers immediately. Ensure Google Chrome is updated to version 89.0.4389.72 or later. Also update Microsoft Edge, Opera, Brave, and any other Chromium-based browsers in your environment to their corresponding patched versions.
- Enable automatic browser updates. Configure browser management policies to enforce automatic updates, preventing users from running outdated versions that remain vulnerable.
- Implement browser isolation for high-risk browsing. Consider deploying browser isolation solutions that render web content in isolated environments, mitigating the impact of browser exploitation.
- Monitor for suspicious browser behavior. Watch for unusual audio processing activity, unexpected Chrome renderer crashes, or signs of code execution within browser processes that could indicate exploitation attempts.
- Restrict access to untrusted web content. Implement web filtering and content security policies to reduce exposure to potentially malicious pages that could trigger this vulnerability.
- Review and update endpoint detection rules. Ensure endpoint security solutions can detect exploitation patterns associated with Chromium heap corruption vulnerabilities, including anomalous memory allocation patterns in audio-related processes.
Technical Details
CVE-2021-21166 is a HIGH-severity race condition vulnerability in the audio processing component of Chromium-based browsers. The vulnerability can be triggered remotely via a crafted HTML page that requires user interaction (visiting the page).
Technical mechanism: The vulnerability is a data race in Chrome's audio subsystem. When multiple threads concurrently access shared audio processing resources without proper synchronization, a timing window exists where memory can be corrupted. Specifically, the race condition can lead to heap corruption when audio buffers are accessed concurrently during audio stream processing. An attacker can craft HTML content with specific audio elements that trigger the race condition, leading to a use-after-free or buffer overflow in heap memory.
Exploitation approach: The attacker creates a web page with carefully crafted audio content designed to trigger the race condition in Chrome's audio processing pipeline. When a user visits the page, the concurrent audio processing threads corrupt heap memory, which the attacker can leverage for arbitrary code execution within the renderer process.
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a network-accessible attack with low complexity (despite being a race condition, it is reliably triggerable), requiring user interaction (page visit), with Unchanged scope and HIGH impact across all three metrics.
Affected versions: Chromium-based browsers prior to the version corresponding to Chrome 89.0.4389.72.
Frequently Asked Questions
Is CVE-2021-21166 being actively exploited?
Yes, CVE-2021-21166 was confirmed by Google as being actively exploited in the wild at the time of discovery. The March 2021 Chrome 89 stable release specifically addressed this zero-day. The EPSS score of 0.36262 (97.04th percentile) confirms very high exploitation likelihood.
What products are affected by CVE-2021-21166?
All Chromium-based browsers prior to the patched version are affected, including Google Chrome (before 89.0.4389.72), Microsoft Edge, Opera, Brave, and other Chromium-derived browsers. Organizations should update all Chromium-based browsers in their environment, not just Chrome.
How do I fix CVE-2021-21166?
Update Google Chrome to version 89.0.4389.72 or later. Update all other Chromium-based browsers to their corresponding patched versions. Enable automatic updates to prevent regression. Consider implementing browser isolation for additional protection against browser-based attacks.
How severe is CVE-2021-21166?
CVE-2021-21166 is rated HIGH with a CVSS score of 8.8 and an EPSS score in the 97.04th percentile. While the Unchanged scope means impact is contained within the browser sandbox, the confirmed zero-day exploitation and the broad attack surface across all Chromium-based browsers make this a high-priority remediation item.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.