CVE-2021-30563KEV · OVERDUE

Google Chromium V8 Type Confusion Vulnerability

High · published August 3, 2021

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 95.3th percentile for exploit probability.

1803
days past CISA
deadline
CVSS v3.1
8.8
EPSS
9%
Percentile
95.3
In the wild
Confirmed
What it is

⚡ A single crafted HTML page is all it takes for an attacker to stir up some serious trouble in Google Chrome! 🔥 Think of this vulnerability like a sneaky chef adding a mysterious ingredient to a recipe without anyone noticing. The dish looks fine, but behind the scenes, it could end up completely spoiled! If exploited, an attacker could cause heap corruption, potentially leading to unauthorized access or even a complete system compromise. It’s like letting a stranger into your kitchen, where they can tamper with everything before you even realize something’s wrong!

Put simply

Think of this vulnerability like a sneaky chef adding a mysterious ingredient to a recipe without anyone noticing. The dish looks fine, but behind the scenes, it could end up completely spoiled! This type confusion vulnerability in Chrome's V8 engine allows an attacker to manipulate memory allocation, potentially leading to arbitrary code execution. It's a clever trick that makes trusted methods behave unpredictably.

What to do

If exploited, an attacker could cause heap corruption, potentially leading to unauthorized access or even a complete system compromise. It’s like letting a stranger into your kitchen, where they can tamper with everything before you even realize something’s wrong! Upgrade your Chrome browser to version 91.0.4472.164 or later immediately to patch this vulnerability. Regularly updating your software is crucial for maintaining security against such threats. 🛡️ You've got this! With a quick update, you’ll restore safety to your browsing experience! 🚀

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.09000 · 95.3th percentile
Published
2021-08-03T18:25Z
KEV added
2021-11-03 · due 2021-11-17
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by Nov 17
    kev
  • 03 AUG 18:25Z
    Type Confusion in V8 in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page
    cvelistv5