CVE-2021-30555
📋 TL;DR
This is a use-after-free vulnerability in Google Chrome's Sharing component that allows heap corruption. Attackers can exploit it by tricking users into installing a malicious extension and visiting a crafted HTML page while performing a user gesture. All Chrome users prior to version 91.0.4472.114 are affected.
💻 Affected Systems
- Google Chrome
- Chromium-based browsers
📦 What is this software?
Chrome by Google
Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...
Learn more about Chrome →⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through arbitrary code execution, potentially leading to data theft, ransomware deployment, or complete system control.
Likely Case
Malicious extension installation leading to data exfiltration, credential theft, or browser session hijacking.
If Mitigated
Limited impact with proper extension vetting and user education preventing malicious extension installation.
🎯 Exploit Status
Requires social engineering to install malicious extension and user interaction on crafted page.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 91.0.4472.114 and later
Vendor Advisory: https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-desktop_17.html
Restart Required: Yes
Instructions:
1. Open Chrome settings 2. Click 'About Chrome' 3. Allow Chrome to update automatically 4. Restart Chrome when prompted
🔧 Temporary Workarounds
Disable extension installation
allPrevent users from installing extensions to block the attack vector
chrome://flags/#extensions-on-chrome-urls (set to Disabled)
Use Group Policy to restrict extension installation
Restrict user permissions
allLimit user ability to install software/extensions
🧯 If You Can't Patch
- Implement strict extension whitelisting policies
- Deploy web filtering to block malicious HTML pages
🔍 How to Verify
Check if Vulnerable:
Check Chrome version in settings > About Chrome. If version is below 91.0.4472.114, system is vulnerable.Check Version:
chrome://version/ or 'google-chrome --version' on LinuxVerify Fix Applied:
Confirm Chrome version is 91.0.4472.114 or higher in settings > About Chrome.📡 Detection & Monitoring
Log Indicators:
- Unexpected extension installations
- Chrome crash reports with sharing component references
Network Indicators:
- Connections to suspicious extension repositories
- Downloads of unusual Chrome extensions
SIEM Query:
source="chrome_logs" AND (event="extension_install" AND extension_name NOT IN approved_list) OR (event="crash" AND component="sharing")🔗 References
- https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-desktop_17.html
- https://crbug.com/1215029
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAT6EOXVQFE6JFMFQF4IKAOUQSHMHL54/
- https://security.gentoo.org/glsa/202107-06
- https://chromereleases.googleblog.com/2021/06/stable-channel-update-for-desktop_17.html
- https://crbug.com/1215029
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ETMZL6IHCTCTREEL434BQ4THQ7EOHJ43/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PAT6EOXVQFE6JFMFQF4IKAOUQSHMHL54/
- https://security.gentoo.org/glsa/202107-06
