CVE-2021-30633
Google Chromium Indexed DB API Use-After-Free Vulnerability
Description
CVE-2021-30633 is a CRITICAL use-after-free vulnerability in Google Chromium's Indexed DB API, carrying a CVSS 3.1 score of 9.6. The vulnerability allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. This flaw affects multiple web browsers that utilize Chromium, including Google Chrome, Microsoft Edge, and Opera. Affected products include Google Chrome (< 93.0.4577.82) and Fedora (33; 35). This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2021-11-17. With an EPSS score of 0.28323 (96.43rd percentile), this vulnerability demonstrates significant real-world exploitation activity and should be prioritized for immediate remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 93.0.4577.82 | |
| fedoraproject | fedora | 33; 35 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop.html(Release Notes)
- https://crbug.com/1247766(Permissions Required)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/(Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PM7MOYYHJSWLIFZ4TPJTD7MSA3HSSLV2/(Release Notes)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-30633(US Government Resource)
Weakness Type
CWE-416: Use After Free
CVE-2021-30633 is classified under CWE-416 — Use After Free. Use After Free (UAF) is a vulnerability that occurs when software continues to use a pointer after the memory it references has been freed. Once memory is freed, it may be reallocated for other purposes. If the dangling pointer is subsequently dereferenced, the program may read or write to memory now used for different data structures, leading to data corruption, information disclosure, or code execution.
In the context of Google Chromium's Indexed DB API, this weakness is particularly dangerous because the Indexed DB API operates across process boundaries in Chrome's multi-process architecture. A use-after-free in this API can be leveraged by an attacker who has already compromised the renderer process (through a separate vulnerability) to escape the browser sandbox. By manipulating the timing of Indexed DB operations and memory allocation patterns, an attacker can control the contents of freed memory and redirect execution flow to gain privileges beyond the sandbox boundary.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2021-30633 carries a CVSS 3.1 score of 9.6 (CRITICAL) with Changed Scope.
Confidentiality (HIGH): Successful exploitation enables a sandbox escape, granting the attacker access to data beyond the browser's security boundary. This can include files on the local system, credentials stored outside the browser sandbox, and data from other applications.
Integrity (HIGH): After escaping the sandbox, attackers can modify system files, install persistent malware, alter configurations, and deploy backdoors with privileges beyond those of the browser process.
Availability (HIGH): Complete system disruption is possible after sandbox escape, including denial of service at the operating system level, destruction of data, or rendering the system inoperable.
Scope Changed: The vulnerability's scope is Changed (C), meaning exploitation can affect resources beyond the vulnerable component. The sandbox escape allows an attacker to break out of the Chromium renderer process and affect the underlying operating system and other applications.
With an EPSS score of 0.28323 (96.43rd percentile), this vulnerability has a high probability of being exploited in real-world attacks, and the Changed scope makes it significantly more dangerous than typical renderer-only vulnerabilities.
Exploit Maturity
CVE-2021-30633 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability was exploited as a zero-day in the wild before patches were available. Google confirmed active exploitation in the September 2021 stable channel update advisory, where it was patched alongside CVE-2021-30632 (V8 out-of-bounds write). The EPSS score of 0.28323 (96.43rd percentile) confirms high real-world exploitation probability.
Ransomware association: As of the latest KEV data, no direct ransomware association has been confirmed for CVE-2021-30633. However, sandbox escape vulnerabilities are highly valued by threat actors and can enable full system compromise when chained with renderer vulnerabilities.
Attack surface: This vulnerability was patched in an emergency update alongside CVE-2021-30632, suggesting coordinated zero-day exploitation. The Indexed DB use-after-free provides sandbox escape capability, which is the critical second stage in browser exploit chains. When combined with a renderer exploit like CVE-2021-30632, it enables complete system compromise.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2021-11-17. All organizations should treat this deadline as a strong recommendation for their own remediation timelines.
Remediation
- Apply vendor patches immediately. Update Google Chrome to version 93.0.4577.82 or later. Consult the vendor advisory at chromereleases.googleblog.com for specific patch guidance.
- Verify affected product versions in your environment. Identify all instances of Chromium-based browsers in your infrastructure, including Google Chrome (< 93.0.4577.82) and any other Chromium-based browsers. Use asset inventory and vulnerability scanning tools.
- Update all Chromium-based browsers. Since this vulnerability affects the Indexed DB API in Chromium, ensure all browsers built on Chromium in your environment are updated to versions containing the fix.
- Implement interim mitigations if patching is delayed. If immediate patching is not feasible, consider restricting access to untrusted websites, implementing browser isolation, and enabling enhanced monitoring for signs of sandbox escape attempts.
- Scan for signs of prior exploitation. Given the confirmed zero-day exploitation and the sandbox escape nature of this vulnerability, thoroughly investigate for signs of system compromise beyond the browser, including unusual process creation, file system modifications, and privilege escalation indicators.
- Update detection signatures and monitoring rules. Ensure endpoint detection tools are configured to detect sandbox escape patterns, unusual browser process behavior, and indicators of compromise associated with Chromium exploitation.
Technical Details
CVE-2021-30633 is a CRITICAL-severity vulnerability in Google Chromium's Indexed DB API that can be exploited remotely over the network. The attack complexity is low, meaning no specialized conditions or preparation are required. No prior authentication or privileges are needed to trigger the vulnerability. User interaction is required, meaning a victim must visit a malicious web page. However, the attacker must first compromise the renderer process through a separate vulnerability.
Technical mechanism: The vulnerability is a use-after-free in Chrome's Indexed DB API implementation. The Indexed DB API handles persistent client-side data storage and involves complex cross-process communication in Chrome's multi-process architecture. The use-after-free occurs when the API's internal objects are freed but references to them persist, allowing a compromised renderer to manipulate the freed memory. By carefully controlling memory allocation patterns, an attacker can place controlled data in the freed memory region, enabling execution of arbitrary code in the browser's privileged process, effectively escaping the sandbox.
Exploit chain context: This vulnerability was patched alongside CVE-2021-30632 (V8 out-of-bounds write), forming a complete browser exploit chain: CVE-2021-30632 provides renderer code execution, and CVE-2021-30633 enables sandbox escape to the operating system.
Affected products: Google Chrome (< 93.0.4577.82), Fedoraproject Fedora (33; 35)
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H reflects a network-based attack with low complexity, no privileges required, user interaction required, Changed scope (sandbox escape), and maximum impact across all three CIA dimensions. The Changed scope is critical — it indicates the vulnerability breaks the browser's security boundary.
Frequently Asked Questions
Is CVE-2021-30633 being actively exploited?
Yes, CVE-2021-30633 was exploited as a zero-day vulnerability in the wild before patches were available. Google confirmed active exploitation in their September 2021 security advisory. The vulnerability was part of an exploit chain with CVE-2021-30632. The EPSS score of 0.28323 (96.43rd percentile) confirms high exploitation probability.
Which products are affected by CVE-2021-30633?
The primary affected product is Google Chrome versions prior to 93.0.4577.82. Since the vulnerability is in the Chromium Indexed DB API, other Chromium-based browsers including Microsoft Edge and Opera are likely affected. Fedora Linux distributions (33, 35) with Chromium packages are also impacted.
How do I fix CVE-2021-30633?
Update Google Chrome to version 93.0.4577.82 or later. This update also fixes CVE-2021-30632, which was exploited together with this vulnerability as part of an exploit chain. For other Chromium-based browsers, apply the corresponding vendor updates. Verify all instances are patched using vulnerability scanning.
How severe is CVE-2021-30633?
CVE-2021-30633 is rated CRITICAL with a CVSS 3.1 score of 9.6 and a Changed scope, meaning it enables sandbox escape beyond the browser's security boundary. Its EPSS score of 0.28323 places it in the 96.43rd percentile for exploitation likelihood. The vulnerability was exploited as a zero-day in an exploit chain with CVE-2021-30632. The CISA remediation deadline was 2021-11-17.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.