CVE-2021-30633: Chrome Indexed DB API use-after-free enables sandbox escape

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.6, CISA KEV listing with known exploitation, and a sandbox escape that yields host-level code execution make this a top remediation priority.

What it is

Google Chrome before 93.0.4577.82 contains a use-after-free in the Indexed DB API. An attacker who has already compromised the renderer process can trigger the flaw with a crafted HTML page to escape the browser sandbox. It matters because sandbox escape turns a renderer compromise into full host-level access.

Impact

An attacker gains code execution outside the Chrome sandbox, on the underlying operating system, with the privileges of the browser process. This escalates a renderer-only foothold into a full machine compromise.

Attack surface

Reached remotely over the network via a crafted HTML page rendered in Chrome; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N). The description states the attacker must already have compromised the renderer process, so this is a second-stage exploit, not a standalone entry point.

Exploitation

Listed in CISA KEV with a due date of 2021-11-17, indicating known exploitation in the wild. EPSS 30-day probability is 0.32657 (98.25th percentile), and no ransomware campaign use is documented.

What to do

• Update Chrome to 93.0.4577.82 or later, and apply the corresponding Fedora package updates.
• Enforce automatic browser updates and verify version compliance across managed endpoints.
• Keep the browser sandbox enabled and avoid running Chrome with --no-sandbox.
• Restrict or monitor high-risk browsing and treat renderer compromise as a precursor to host compromise in incident response.

Detection

• Alert on Chrome versions below 93.0.4577.82 in asset inventory or endpoint telemetry.
• Hunt for browser processes spawning unexpected child processes or making anomalous outbound connections after page loads.
• Monitor for crashes or memory corruption indicators in the renderer tied to Indexed DB activity.
• Correlate endpoint detections of sandbox-escape behavior with recent browsing of untrusted or crafted pages.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.