CVE-2021-30546 – This is a use-after-free vulnerability in Chrom... (How to Fix)

Q: What is the severity of CVE-2021-30546?

CVE-2021-30546 has a CVSS score of 8.8 (HIGH). This is a use-after-free vulnerability in Chrome's Autofill feature that allows remote attackers to potentially exploit heap corruption. Attackers can craft malicious HTML pages to trigger memory corruption, potentially leading to arbitrary code execution. All users running Chrome versions prior to 91.0.4472.101 are affected.

📋 TL;DR

This is a use-after-free vulnerability in Chrome's Autofill feature that allows remote attackers to potentially exploit heap corruption. Attackers can craft malicious HTML pages to trigger memory corruption, potentially leading to arbitrary code execution. All users running Chrome versions prior to 91.0.4472.101 are affected.

💻 Affected Systems

Products:

Google Chrome
Chromium-based browsers

Versions: All versions prior to 91.0.4472.101

Operating Systems: Windows, Linux, macOS, Android

Default Config Vulnerable: ⚠️ Yes

Notes: All default Chrome configurations are vulnerable. Chromium-based browsers may also be affected depending on their patch level.

📦 What is this software?

Chrome by Google

Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...

Learn more about Chrome →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

Fedora by Fedoraproject

View all CVEs affecting Fedora →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution with the same privileges as the Chrome process, potentially leading to full system compromise if Chrome runs with elevated privileges.

🟠

Likely Case

Browser crash (denial of service) or limited information disclosure through memory corruption.

🟢

If Mitigated

No impact if Chrome is fully patched or if exploit attempts are blocked by security controls.

🌐 Internet-Facing: HIGH - Attackers can host malicious websites accessible from the internet.

🏢 Internal Only: MEDIUM - Requires user interaction (visiting malicious page) but could be exploited via internal phishing campaigns.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ⚠️ Yes

Complexity: MEDIUM

Exploitation requires user interaction (visiting malicious page) but no authentication. The bug report suggests the vulnerability is exploitable for heap corruption.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 91.0.4472.101 and later

Vendor Advisory: https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-desktop.html

Restart Required: Yes

Instructions:

1. Open Chrome. 2. Click the three-dot menu → Help → About Google Chrome. 3. Chrome will automatically check for and install updates. 4. Click 'Relaunch' to restart Chrome with the update.

🔧 Temporary Workarounds

Disable Autofill

all

Temporarily disable Chrome's Autofill feature to mitigate the vulnerability

Use Chrome sandboxing

all

Ensure Chrome runs with sandboxing enabled to limit potential impact

🧯 If You Can't Patch

Restrict web browsing to trusted sites only using browser policies
Implement network filtering to block malicious websites and exploit kits

🔍 How to Verify

Check if Vulnerable:

Check Chrome version: if below 91.0.4472.101, the system is vulnerable.

Check Version:

On Windows/Linux/macOS: chrome://version/ or 'google-chrome --version' in terminal

Verify Fix Applied:

Verify Chrome version is 91.0.4472.101 or higher after update.

📡 Detection & Monitoring

Log Indicators:

Chrome crash reports with memory corruption signatures
Unexpected Chrome process termination

Network Indicators:

HTTP requests to suspicious domains with crafted form data
Unusual Autofill-related network activity

SIEM Query:

source="chrome" AND (event_type="crash" OR memory_corruption="true")

📊 Metadata

CVE ID: CVE-2021-30546

CVSS v3 Score: 8.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CWE: CWE-416

Published: June 15, 2021

Last Updated: November 21, 2024

🔗 References

https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-desktop.html Release Notes,Vendor Advisory
https://crbug.com/1206911 Issue Tracking,Permissions Required,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAT6EOXVQFE6JFMFQF4IKAOUQSHMHL54/
https://security.gentoo.org/glsa/202107-06 Third Party Advisory
https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-desktop.html Release Notes,Vendor Advisory
https://crbug.com/1206911 Issue Tracking,Permissions Required,Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAT6EOXVQFE6JFMFQF4IKAOUQSHMHL54/
https://security.gentoo.org/glsa/202107-06 Third Party Advisory

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2021-30546, you might also want to check these: