CVE-2021-30554: Google Chrome WebGL use-after-free enables heap corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityRemote, unauthenticated code execution risk in a widely deployed browser with confirmed exploitation per CISA KEV, though it requires user interaction.

What it is

Google Chrome before 91.0.4472.114 contains a use-after-free flaw in WebGL. A crafted HTML page can trigger the bug and corrupt heap memory, which makes it a serious browser-side memory safety issue.

Impact

An attacker who gets the page rendered can potentially achieve heap corruption, which typically leads to code execution or a crash in the browser process. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reached over the network by loading a crafted HTML page in Chrome; the vector requires user interaction (UI:R) and no privileges (PR:N). No authentication is needed.

Exploitation

Listed in CISA KEV with a 2021-11-03 addition and 2021-11-17 remediation due date, indicating known exploitation. EPSS 30-day probability is 0.07367 (94th percentile), and no ransomware campaign use is documented.

What to do

• Update Chrome to 91.0.4472.114 or later, and apply the corresponding Fedora and Gentoo package updates.
• Enforce automatic browser updates and verify version compliance across endpoints.
• Restrict or disable WebGL where it is not required by business applications.
• Keep browser and OS patching on a short cycle given the KEV listing.

Detection

• Alert on Chrome versions below 91.0.4472.114 in asset inventory.
• Monitor for browser crashes or renderer process terminations that could indicate heap corruption attempts.
• Hunt for exploit delivery via crafted HTML pages and suspicious WebGL-related content in web or email gateways.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.