CVE-2021-21108: 
Google Chrome vulnerability analysis and mitigation

CVE-2021-21108 is a Use-after-free vulnerability discovered in the media component of Google Chrome versions prior to 87.0.4280.141. The vulnerability was reported by Leecraso and Guang Gong of 360 Alpha Lab on December 4, 2020, and was officially disclosed on January 6, 2021 (Chrome Release).

The vulnerability is classified as a Use-after-free (CWE-416) issue in the media component of Chrome. It received a CVSS v3.1 base score of 9.6 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, indicating network accessibility, low attack complexity, no privileges required, and user interaction required (NVD).

If successfully exploited, this vulnerability could allow a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. The high severity rating and CVSS score indicate potential for significant impact on confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability requires the attacker to first compromise the renderer process and then use a crafted HTML page to execute the exploit. The attack complexity is rated as low, though user interaction is required for successful exploitation (NVD).

Google released a patch in Chrome version 87.0.4280.141 to address this vulnerability. Users and administrators are advised to upgrade to this version or later. The fix was also incorporated into various Linux distributions including Debian (87.0.4280.141-0.1~deb10u1), Fedora 32 and 33, and Ubuntu (Debian Advisory, Fedora Update).