Skip to main content
Live Webinar with SANS (June 25)— Agentic CTI Automation for Fun & ProfitRegister Free
Mallory
HighCISA KEVExploited in the wildPublic exploit

Type Confusion in Google Chrome V8

IdentifiersCVE-2021-30551CWE-843· Access of Resource Using…

CVE-2021-30551 is a type confusion vulnerability in the V8 JavaScript engine in Google Chrome prior to 91.0.4472.101. According to the provided content, a remote attacker could trigger heap corruption by luring a target to a crafted HTML page. The flaw affects Chrome’s V8 engine and results from incorrect type handling that can place objects into an invalid state during JavaScript execution, leading to memory corruption. The supporting content also notes that Google TAG reported this vulnerability was exploited by Candiru in 2021 via single-use links sent to targets believed to be in Armenia.

Share:
For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can cause heap corruption in the browser process and may enable remote code execution in the context of the targeted Chrome renderer or browser component, depending on exploit chain design and available sandbox escapes. At minimum, the vulnerability provides a path to memory corruption from web content. The supplied context further indicates the flaw was used in targeted exploitation campaigns, demonstrating practical offensive value for initial compromise via the browser.

Mitigation

If you can’t patch tonight, do this now.

Where immediate patching is not possible, reduce exposure by restricting use of untrusted web content, isolating high-risk browsing activity, and applying enterprise browser hardening controls. Disable or limit access to external links for high-risk users where operationally feasible, use application isolation or remote browser isolation for sensitive roles, and monitor for suspicious browser crashes or exploit-chain indicators. These are compensating controls only; patching is the primary mitigation.

Remediation

Patch, then assume compromise.

Upgrade Google Chrome to version 91.0.4472.101 or later. Apply the corresponding Chromium-based browser updates from downstream vendors as they become available. Standard remediation is to ensure all affected Chrome installations and embedded Chromium distributions are updated to a fixed build that addresses the V8 type confusion issue.
PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app
CVE-2021-30551MaturityPoCVerified exploit

This repository contains a proof-of-concept exploit for CVE-2021-30551, a type confusion vulnerability in the V8 JavaScript engine used by Google Chrome. The repository consists of a README.md with usage instructions and a single exploit file, exp.html. The exploit is implemented in JavaScript and HTML, leveraging advanced techniques such as WebAssembly, out-of-bounds array manipulation, and arbitrary read/write primitives to achieve code execution. The payload is x64 shellcode that spawns a shell, demonstrating arbitrary code execution in the browser process. The exploit is intended to be served via a local web server and accessed by a vulnerable version of Chrome. The code is operational and demonstrates the full exploitation chain, but is not weaponized for mass exploitation. No external network endpoints are hardcoded in the exploit itself, but the README provides example URLs for local testing and version checking.

xmzyshypncDisclosed Aug 22, 2021javascripthtmlbrowser
EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType
Fedora ProjectFedoraoperating_system
GoogleChromeapplication

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.
Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence2

Every observed campaign linking this CVE to a named adversary.

Associated malware2

Malware families riding this exploit, with evidence and IOCs.

Detection signatures2

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity

Community discussion across Reddit, Mastodon, and other social sources.