CVE-2021-30633VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2021-30633: Google Chromium Indexed DB API Use-After-Free Vulnerability

Affects Google Chromium Indexed DB APISource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 11/17/2021
EPSS: 33.2% chance of exploitation in 30 days – higher than 98% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2021-30633 (opens in a new tab)

Description

CVE-2021-30633 is a use-after-free vulnerability in the Google Chromium Indexed DB API. It allows a remote attacker who has compromised the renderer process to potentially escape the sandbox by using a crafted HTML page. This vulnerability affects multiple Chromium-based browsers such as Google Chrome, Microsoft Edge, and Opera. Exploits have been observed in the wild. No explicit patch information is provided in the input data.

Summary

The vulnerability CVE-2021-30633 exists in the Indexed DB API implementation within Chromium. It is a use-after-free flaw that can be triggered by a remote attacker who has already compromised the renderer process, enabling the attacker to potentially perform a sandbox escape. This could allow the attacker to execute code outside the browser sandbox, increasing the impact of a compromise. Multiple Chromium-based browsers are affected due to their shared codebase. Exploitation has been confirmed in the wild, indicating active threat usage.

Impact

Successful exploitation of this vulnerability can lead to sandbox escape from the renderer process, which significantly increases the attacker's privileges and ability to execute arbitrary code on the host system. This elevates the risk of further system compromise beyond the browser sandbox. The vulnerability affects multiple widely used Chromium-based browsers, increasing the potential attack surface.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is confirmed, users should ensure their browsers are updated to the latest available versions as vendors typically release security updates for such vulnerabilities. Monitor vendor advisories from Google and other Chromium-based browser vendors for patches addressing CVE-2021-30633.

Weaknesses

CWE-416Use After Free (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:26:08 UTC

Weaknesses

References

Related threats