Vulnerability record · CVE-2021-30551 · published 15 June 2021
CVE-2021-30551: Google Chrome V8 type confusion enables heap corruption
Google · Chrome
Google Chrome before 91.0.4472.101 contains a type confusion flaw in the V8 JavaScript engine. A crafted HTML page can trigger the confusion and potentially corrupt the heap, which matters because the browser is widely deployed and the flaw was exploited in the wild.
Description
Type confusion in V8 in Google Chrome prior to 91.0.4472.101 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityCVSS 8.8, confirmed KEV exploitation and very high EPSS probability make this a high-priority patch despite the need for user interaction.
What it is
Google Chrome before 91.0.4472.101 contains a type confusion flaw in the V8 JavaScript engine. A crafted HTML page can trigger the confusion and potentially corrupt the heap, which matters because the browser is widely deployed and the flaw was exploited in the wild.
Impact
A remote attacker can potentially achieve heap corruption, which typically leads to code execution in the browser process context. The CVSS vector rates confidentiality, integrity and availability impact as high.
Attack surface
Reached over the network by loading a crafted HTML page; no privileges are required but user interaction (opening the page) is needed per the CVSS vector. No authentication is required.
Exploitation
The vulnerability is listed in CISA KEV with a 2021-11-03 addition date, and EPSS shows a 30-day probability of 0.64701 (99.2nd percentile). A reference is tagged Exploit, indicating public exploit material exists.
What to do
- Update Chrome to 91.0.4472.101 or later, and apply the corresponding Fedora and Gentoo updates.
- Track the CISA KEV due date of 2021-11-17 and confirm all endpoints are patched.
- Enforce automatic browser updates and verify version compliance across managed fleets.
- Restrict or sandbox browser use for high-risk users where patching lags.
Detection
- Monitor for Chrome processes spawning unexpected child processes or writing to unusual paths.
- Alert on crashes in the V8/renderer process that correlate with visits to untrusted sites.
- Hunt for known exploit page indicators in proxy or DNS logs tied to the crbug.com/1216437 report.
- Check endpoint inventory for Chrome versions below 91.0.4472.101.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2021-30551 to the Known Exploited Vulnerabilities catalog on 3 November 2021 as "Google Chromium V8 Type Confusion Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 17 November 2021.
Affected products
2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2021-30551 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-30551), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
