Vulnerability Spotlight: Heap-based buffer overflow in Google Chrome could lead to code execution

Summary: Cisco Talos discovered an exploitable heap-based buffer overflow in Google Chrome's AudioDelay function, tracked as TALOS-2021-1235 (CVE-2021-21160), that could allow an adversary to execute remote code. An attacker could exploit it by tricking a user into visiting a specially crafted HTML page, and proper heap grooming could turn the overflow into arbitrary code execution; Talos confirmed Chrome versions 89.0.4383.0 and 90.0.4390.0 (64-bit) were exploitable and worked with Google on an update.
Key Takeaway: Exploitation needs only a crafted HTML page and a user who visits it, and Talos confirmed the flaw against specific Chrome builds, so unpatched browsers on those versions remain exposed until updated.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2021-21160
Related: Threat Source newsletter (May 27, 2021) Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026