Log in Start free

Actively exploited · Published Oct 8, 2021 · Assigned by Chrome

CVE-2021-30633

Critical 9.6 Exploited

In plain English

A critical-severity use-after-free in Chrome from Google. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 33.2% (higher than 98% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.6Critical
Exploit odds (30 days)33.2%top 1.6% of all CVEs
Exploited in the wildYesCISA KEV since Nov 3, 2021
Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Nov 17, 2021.

Official description

Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20chromium93.0.4577.82-r0ALPINE-CVE-2021-30633
Alpine:v3.21chromium93.0.4577.82-r0ALPINE-CVE-2021-30633
Alpine:v3.22chromium93.0.4577.82-r0ALPINE-CVE-2021-30633
Alpine:v3.23chromium93.0.4577.82-r0ALPINE-CVE-2021-30633
Alpine:v3.24chromium93.0.4577.82-r0ALPINE-CVE-2021-30633
Alpine:v3.20qt5-qtwebengine5.15.3_git20211006-r0ALPINE-CVE-2021-30633
Alpine:v3.21qt5-qtwebengine5.15.3_git20211006-r0ALPINE-CVE-2021-30633
Alpine:v3.22qt5-qtwebengine5.15.3_git20211006-r0ALPINE-CVE-2021-30633
Alpine:v3.23qt5-qtwebengine5.15.3_git20211006-r0ALPINE-CVE-2021-30633
Debian:12chromium93.0.4577.82-1DEBIAN-CVE-2021-30633
Debian:13chromium93.0.4577.82-1DEBIAN-CVE-2021-30633
Debian:14chromium93.0.4577.82-1DEBIAN-CVE-2021-30633

Affected products (as reported)

VendorProductVersions
Google Chrome unspecified – before 93.0.4577.82

Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

References