CVE-2021-30632

CVE-2021-30632 is an out-of-bounds write (CWE-787) in V8, the JavaScript engine used by Google Chrome and other Chromium-based browsers, affecting Chrome versions prior to 93.0.4577.82. A remote attacker can trigger the flaw by luring a user to a crafted HTML page, since the vulnerable code is reached when the browser processes attacker-supplied web content (user interaction is required per the CVSS vector). Successful exploitation corrupts the heap and can allow the attacker to execute code within the browser process, with high impact on confidentiality, integrity, and availability. Anyone running an unpatched version of Chrome or Chromium — including Fedora's packaged Chromium/Chrome — is affected. The vulnerability was known to be actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2021-11-03, EPSS assigns a 63.2% probability of exploitation within 30 days, and it was among the 15+ Chrome zero-days Google patched during 2021, though no public proof-of-concept is known.

What to do: Update Google Chrome to 93.0.4577.82 or later on all platforms and restart the browser so the new V8 is loaded; on Fedora, apply the updated chromium/chrome packages through the normal update channel. Because this flaw is on the CISA KEV catalog, federal and critical-infrastructure teams should patch per vendor instructions on the required timeline; defenders should also verify no unmanaged or Kiosk-style Chromium installs remain below the fixed version.