CVE-2021-30633: critical vulnerability in Google Chrome
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
A memory safety flaw in Chrome's Indexed DB feature allows attackers who control the browser's renderer process to escape the security sandbox by using a specially crafted webpage. This could lead to complete system compromise.
Use-after-free vulnerability in Indexed DB API allows an attacker with renderer process compromise to trigger unsafe memory access and bypass sandbox isolation. Exploitation requires delivering a malicious HTML page to an already-compromised renderer context, enabling potential privilege escalation to host system.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.