Chrome V8 Engine Bug

The flaw, tracked as CVE-2021-21227 and rated high severity, which Google described as “insufficient data validation in V8.”

The flaw can be exploited for remote code execution in the targeted user’s browser, but noted that, similar to other recently disclosed V8 vulnerabilities, it does not escape the Chrome sandbox a sandbox escape bug is needed to exploit CVE-2021-21227 in real world attacks.

The hacker says CVE-2021-21227 is related to CVE-2020-16040 and CVE-2020-15965, similar high-severity V8 vulnerabilities that Google patched in Chrome in December and September 2020, respectively.

Google has patched several serious V8 vulnerabilities in recent weeks, including some for which PoC exploits were released before patches were made available.Google warned that exploits exist in the wild.

The Chrome 90 update released this week ( 90.0.4430.93) includes 9 security fixes, including for a couple of other high-severity issues, three medium-severity bugs, and one low-severity vulnerability. Bug bounty amounts are not listed, except for a medium-severity insufficient policy enforcement issue reported by researcher.