Overview
Google has issued a new update to patch for recently discovered 14 vulnerabilities that exist in Chrome browser. Chrome for Windows, Mac and Linux should be updated immediately, as one of the vulnerabilities is a zero-day (CVE-2021-30551) and known to be exploited in the wild.
Description
Google has released a new version (91.0.4472.101) for Chrome for Windows, Mac and Linux to patch for a total of 14 security vulnerabilities. So far, Google has disclosed limited information, such as CVE identifiers and vulnerability types, on the recently discovered vulnerabilities.
Google also announced that one of these vulnerabilities (CVE-2021-30551) is a zero-day and actively exploited in the wild with a known exploit for it.
Further details on the disclosed vulnerabilities are as follows:
- CVE-2021-30544: Use After Free in BFCache. Severity: High
- CVE-2021-30545: Use After Free in Extensions. Severity: High
- CVE-2021-30546: Use After Free in Autofill. Severity: High
- CVE-2021-30547: Out of Bounds Write in ANGLE. Severity: High
- CVE-2021-30548: Use After Free in Loader. Severity: High
- CVE-2021-30549: Use After Free in Spell Check. Severity: High
- CVE-2021-30550: Use After Free in Accessibility. Severity: High
- CVE-2021-30551: Type Confusion in V8. Severity: High (Zero-Day)
- CVE-2021-30552: Use After Free in Extensions. Severity: High
- CVE-2021-30553: Use After Free in Network Service. Severity: High
Google additionally shared the names of the tools for detecting these vulnerabilities. Following are a list of the tools used by Google for bug discovery:
Impact
A remote attacker, who successfully exploits the CVE-2021-30544 by causing heap corruption in BFCache via a crafted HTML page, could execute arbitrary code and gain full control of the system.
Impact Summary CVE-2021-30544
Category: Use After Free
CVSS 3.1 Base Score: 8.8 High
CVSS 3.1 Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
A remote attacker, who successfully exploits the CVE-2021-30545 by causing heap corruption in the renderer process via a crafted HTML page, could execute arbitrary code and gain full control of the system.
Impact Summary CVE-2021-30545
Category: Use After Free
CVSS 3.1 Base Score: 8.8 High
CVSS 3.1 Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
A remote attacker, who successfully exploits the CVE-2021-30546 by causing heap corruption in Autofill via a crafted HTML page, could execute arbitrary code and gain full control of the system.
Impact Summary CVE-2021-30546
Category: Use After Free
CVSS 3.1 Base Score: 8.8 High
CVSS 3.1 Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
A remote attacker, who successfully exploits the CVE-2021-30547 by performing out of bounds memory access in ANGLE, could gain unauthorized access on the system, leading to information disclosure.
Impact Summary CVE-2021-30547
Category: Buffer Over Flow
CVSS 3.1 Base Score: 8.8 High
CVSS 3.1 Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
A remote attacker, who successfully exploits the CVE-2021-30548 by causing heap corruption in Loader via a crafted HTML page, could execute arbitrary code and gain full control of the system.
Impact Summary CVE-2021-30548
Category: Use After Free
CVSS 3.1 Base Score: 8.8 High
CVSS 3.1 Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
A remote attacker, who upon convincing a user to install a malicious extension successfully exploits the CVE-2021-30549 by causing heap corruption in Spell Check via a crafted HTML page, could execute arbitrary code and gain full control of the system.
Impact Summary CVE-2021-30549
Category: Use After Free
CVSS 3.1 Base Score: 8.8 High
CVSS 3.1 Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
A remote attacker, who upon convincing a user to install a malicious extension successfully exploits the CVE-2021-30550 by causing heap corruption in Accessibility via a crafted HTML page, could execute arbitrary code and gain full control of the system.
Impact Summary CVE-2021-30550
Category: Use After Free
CVSS 3.1 Base Score: 8.8 High
CVSS 3.1 Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
A remote attacker, who successfully exploits the CVE-2021-30551 by causing heap corruption in V8 via a crafted HTML page, could execute arbitrary code and gain full control of the system.
Impact Summary CVE-2021-30551
Category: Buffer Over Flow
CVSS 3.1 Base Score: 8.8 High
CVSS 3.1 Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
A remote attacker, who upon convincing a user to install a malicious extension successfully exploits the CVE-2021-30552 by causing heap corruption in Extensions via a crafted HTML page, could execute arbitrary code and gain full control of the system.
Impact Summary CVE-2021-30552
Category: Use After Free
CVSS 3.1 Base Score: 8.8 High
CVSS 3.1 Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
A remote attacker, who successfully exploits the CVE-2021-30553 by causing heap corruption in Network Service via a crafted HTML page, could execute arbitrary code and gain full control of the system.
Impact Summary CVE-2021-30553
Category: Use After Free
CVSS 3.1 Base Score: 8.8 High
CVSS 3.1 Vector: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Solution (Update)
To defend against possible attacks due to these vulnerabilities, Google Chrome needs to be updated to the stable version 91.0.4472.101.
Normally, Chrome updates in the background when it is closed and reopened. However, if it has not been closed for a while, there might be pending updates. To check for pending updates, you can click More
(Three vertical dots) on the top right of the Chrome browser.


I am regularly asked what the average Internet user can do to ensure his security. My first answer is usually ‘Nothing; you’re screwed’.
Bruce Schneier
References to Advisories, Solutions and Tools
To learn more about security vulnerabilities, you could also read our articles What is a Security Vulnerability? or What is Vulnerability Scanning?