{"id":"CVE-2021-30563","kind":"vulnerability","aliases":["CVE-2021-30563"],"related":[],"title":"Google Chromium V8: Google Chromium V8 Type Confusion Vulnerability","description":"Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.\n\nCISA required action: Apply updates per vendor instructions.","summary":"A type confusion bug in the V8 JavaScript engine used by Chromium browsers lets a crafted HTML page corrupt heap memory. An attacker who gets a victim to load that page can potentially run code in the browser.","severity":"high","cvss":8.8,"epss":0.09,"exploited":true,"exploited_at":"2021-11-03T00:00:00+00:00","products":[{"name":"Google Chromium V8","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browser-users","chrome","chromium","edge","exploited","opera","other"],"not_affected_if":["already-patched-browser"],"how_to_check":"Open the browser's version page (chrome://version or edge://version) and compare the Chromium version with the fixed release in the vendor advisory.","fix":"Update Google Chrome, Microsoft Edge, Opera or other Chromium-based browsers to a release that includes the vendor's fix for CVE-2021-30563.","status":"open","published_at":"2021-08-03T19:15:08+00:00","first_seen_at":"2026-10-23T19:11:53+00:00","triaged_at":"2026-10-23T21:43:32+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T21:43:32Z","model":"claude-haiku-5-5","output":{"fix":"Update Google Chrome, Microsoft Edge, Opera or other Chromium-based browsers to a release that includes the vendor's fix for CVE-2021-30563.\nunknown","reach":"internet","impact":"high","summary":"A type confusion bug in the V8 JavaScript engine used by Chromium browsers lets a crafted HTML page corrupt heap memory. An attacker who gets a victim to load that page can potentially run code in the browser.","category":"other","who_cares":["chrome","edge","opera","chromium","browser-users"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs code inside the browser after the victim visits a crafted page","analyst_note":"Confirm fixed Chromium version and vendor advisory link from the Chrome releases blog or the CISA KEV entry; sources give no affected or fixed versions.","how_to_check":"Open the browser's version page (chrome://version or edge://version) and compare the Chromium version with the fixed release in the vendor advisory.\nunknown","needs_analyst":true,"not_affected_if":["already-patched-browser"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000499,"input_tokens":2887,"output_tokens":420,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2021':11A,14A '-30563':12A,15A 'action':112C 'affect':92C 'allow':75C 'appli':113C 'attack':49B,78C 'browser':20B,39B,64B,95C 'browser-us':19B 'bug':30B 'chrome':22B,105C 'chromium':2A,5A,17A,23B,38B,66C,98C 'cisa':110C 'code':61B 'confus':8A,29B,72C 'contain':69C 'corrupt':45B,83C 'could':91C 'craft':42B,86C 'cve':10A,13A 'edg':24B,107C 'engin':35B,68C 'exploit':25B,81C 'get':51B 'googl':1A,4A,65C,104C 'google':16A 'heap':46B,82C 'html':43B,87C 'includ':99C 'instruct':117C 'javascript':34B 'let':40B 'limit':102C 'load':55B 'memori':47B 'microsoft':106C 'multipl':93C 'opera':26B,109C 'page':44B,57B,88C 'per':115C 'potenti':59B,80C 'remot':77C 'requir':111C 'run':60B 'type':7A,28B,71C 'updat':114C 'use':36B 'user':21B 'util':97C 'v8':3A,6A,18A,33B,67C 'vendor':116C 'via':84C 'victim':53B 'vulner':9A,73C,90C 'web':94C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2021-08-03T19:15:08+00:00","kev":{"dateAdded":"2021-11-03","dueDate":"2021-11-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2021-30563","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2021-30563","severity":null,"published_at":"2021-11-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:53+00:00","fetched_at":"2026-10-25T10:39:08+00:00","note":null},{"source":"epss","external_id":"CVE-2021-30563","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-30563","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2021-30563","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-30563","severity":null,"published_at":"2021-08-03T19:15:08+00:00","modified_at":"2026-06-17T03:50:28+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}