Vulnerability Spotlight: Use-after-free in Google Chrome could lead to code execution

Summary: Cisco Talos discovered a use-after-free vulnerability, TALOS-2021-1398 (CVE-2021-38008), in a Google Chrome object responsible for creating audio and video streams; opening a specially crafted web page can trigger the condition and potentially lead to remote code execution. Talos confirmed that Chrome versions 94.0.4606.81 (Stable) and 97.0.4674.1 (Canary) could be exploited, worked with Google on an update, and published Snort rules 58489 and 58490 to detect exploitation attempts.
What you should know: The exploit path is a single crafted web page opened in a browser that sits on nearly every desk, and Talos confirmed the named Chrome builds could be exploited before the fix shipped.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-38008
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026