CVE-2021-21135: 
Google Chrome vulnerability analysis and mitigation

A vulnerability identified as CVE-2021-21135 was discovered in Google Chrome's Performance API implementation prior to version 88.0.4324.96. The vulnerability was disclosed on February 9, 2021, affecting Google Chrome browsers and Microsoft Edge Chromium-based browsers (NVD, Chrome Blog).

The vulnerability stems from an inappropriate implementation in the Performance API that could allow cross-origin data leakage through a crafted HTML page. The issue has been assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, indicating network-based attack vector with low attack complexity, requiring user interaction, and potentially resulting in high confidentiality impact (NVD).

The vulnerability could allow a remote attacker to leak cross-origin data when a user interacts with a specially crafted HTML page. This presents a significant confidentiality risk as it could lead to unauthorized access to cross-origin information (NVD).

The vulnerability requires user interaction to be exploited, with the attack being possible over the network. The attack complexity is rated as low, indicating that the exploitation is straightforward once the user interaction requirement is met (NVD).

The vulnerability was addressed in Google Chrome version 88.0.4324.96 and Microsoft Edge Chromium version 88.0.705.50. Users are advised to update their browsers to these versions or later to mitigate the risk (Chrome Blog).