CVE-2021-30633: Use after free in Indexed DB API
Google Chromium Indexed DB API contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Other sources
Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 93.0.4577.82 - Upgrade
Upgrade
alpine/chromiumto a version that resolves this vulnerability.Fixed in 93.0.4577.82-r0 - Upgrade
Upgrade
alpine/qt5-qtwebengineto a version that resolves this vulnerability.Fixed in 5.15.3_git20211006-r0
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2021-30633?
CVE-2021-30633 is a use-after-free vulnerability in the Google Chromium Indexed DB API that allows a remote attacker to potentially perform a sandbox escape.
Which software is affected by CVE-2021-30633?
Web browsers that utilize Chromium, including Google Chrome and Fedora versions 33 and 35, are affected by CVE-2021-30633.
How severe is CVE-2021-30633?
CVE-2021-30633 has a severity value of 9.6, which is considered critical.
How can a remote attacker exploit CVE-2021-30633?
A remote attacker who has compromised the renderer process can potentially perform a sandbox escape by using a crafted HTML page.
Are there any references related to CVE-2021-30633?
Yes, you can find more information about CVE-2021-30633 in the following references: [Google Chrome Releases](https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop.html), [Chromium Bug Tracker](https://crbug.com/1247766), [Fedora Project](https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/).