LiveActive security incident?Get immediate response
CVE Record

CVE-2021-30573: Use after free in GPU in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially expl...

Use after free in GPU in Google Chrome prior to 92.0.4515.107 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

This is a Chrome browser memory safety flaw in the GPU component. A user visiting a crafted HTML page could potentially trigger heap corruption in Chrome versions before 92.0.4515.107. The sources identify a fixed Chrome release but do not provide CVSS, detailed impact, or confirmed exploitation.

Executive priority

Treat this as a high-priority browser patching issue because exploitation could begin from normal web browsing. Urgency is reduced slightly by the lack of cited active exploitation or CVSS data in the provided sources, but outdated browsers remain a common enterprise exposure.

Technical view

CVE-2021-30573 is a use-after-free vulnerability in Google Chrome GPU handling before version 92.0.4515.107. The CVE description says a remote attacker could potentially exploit heap corruption through crafted HTML. Public bug details appear limited, and the bundle provides no CVSS vector or CWE mapping.

Likely exposure

Exposure is most likely on endpoints running Google Chrome earlier than 92.0.4515.107, including managed desktops and Linux packages that lagged vendor updates. The provided affected data only names Google Chrome and does not identify Chromium-based derivatives.

Exploitation context

The source bundle does not show CISA KEV listing and does not cite active exploitation for CVE-2021-30573. Practical exposure depends on users reaching attacker-controlled or compromised web content in an unpatched browser.

Researcher notes

The public record is sparse: description, affected product, fixed Chrome release, and Fedora advisories are available, but CVSS, CWE, detailed root cause, and exploit-in-the-wild evidence are absent from the supplied bundle. Avoid assuming impact beyond potential heap corruption via crafted HTML.

Mitigation direction

  • Update Google Chrome to 92.0.4515.107 or later.
  • Apply relevant Fedora Chromium or Chrome package updates where applicable.
  • Check vendor advisories for platform-specific package names and backports.
  • Prioritize browser update compliance on internet-facing user workstations.

Validation and detection

  • Inventory Chrome versions across managed endpoints.
  • Flag Chrome versions earlier than 92.0.4515.107.
  • Review Linux package advisories for applied fixed builds.
  • Confirm browser auto-update policy is enabled and reporting correctly.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2021-30573 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
GoogleChromeunspecifiedListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.