CVE-2021-30560: Google Chrome Use After Free Vulnerability

CVE-2021-30560 Overview

CVE-2021-30560 is a Use After Free vulnerability in the Blink XSLT component of Google Chrome prior to version 91.0.4472.164. This memory corruption flaw allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. The vulnerability arises from improper memory management in the XSLT processing engine, where freed memory can be accessed and manipulated by attackers.

Critical Impact

Remote attackers can achieve heap corruption through specially crafted HTML pages, potentially leading to arbitrary code execution, information disclosure, or system compromise with user-level privileges.

Affected Products

• Google Chrome (versions prior to 91.0.4472.164)
• xmlsoft libxslt
• Debian Linux 10.0 and 11.0
• Splunk Universal Forwarder (including version 9.1.0)

Discovery Timeline

• 2021-08-03 - CVE-2021-30560 published to NVD
• 2025-05-05 - Last updated in NVD database

Technical Details for CVE-2021-30560

Vulnerability Analysis

This Use After Free vulnerability (CWE-416) exists within the Blink rendering engine's XSLT processing functionality. Use After Free conditions occur when a program continues to reference memory after it has been freed, potentially allowing attackers to manipulate the freed memory region to achieve arbitrary code execution or other malicious outcomes.

In this case, the vulnerable code path is triggered when processing XSLT transformations within HTML content. When a user visits a maliciously crafted webpage containing specially designed XSLT content, the browser's XSLT parser can be tricked into accessing memory that has already been deallocated. This creates an exploitable condition where an attacker can potentially control the contents of the freed memory region.

The attack requires user interaction—specifically, the victim must navigate to or be redirected to a malicious webpage. Once triggered, successful exploitation could lead to arbitrary code execution within the context of the browser process, potentially allowing attackers to execute malicious code with the same privileges as the logged-in user.

Root Cause

The root cause of this vulnerability lies in improper memory lifecycle management within the Blink XSLT implementation. During XSLT transformations, certain objects are freed prematurely while references to those objects still exist elsewhere in the code. When these dangling references are subsequently accessed, the program operates on memory that may have been reallocated for other purposes, leading to heap corruption and potential arbitrary code execution.

The libxslt library, which is used by multiple products including Google Chrome, is the underlying component affected by this vulnerability. This explains why the vulnerability impacts not only Chrome but also other products that depend on libxslt for XSLT processing, including Debian Linux distributions and Splunk Universal Forwarder.

Attack Vector

The attack is conducted over the network and requires user interaction to succeed. An attacker must craft a malicious HTML page containing specially designed XSLT content and convince a victim to visit the page. The attack flow typically follows this pattern:

1. The attacker creates a webpage with embedded malicious XSLT content designed to trigger the Use After Free condition
2. The victim is lured to visit the malicious page through phishing, malvertising, or compromised legitimate websites
3. The victim's browser processes the XSLT content, triggering the memory corruption vulnerability
4. If successful, the attacker achieves heap corruption that can be leveraged for arbitrary code execution

The vulnerability does not require any special privileges, making it accessible to opportunistic attackers who can host or inject malicious content on websites visited by potential victims.

Detection Methods for CVE-2021-30560

Indicators of Compromise

• Unusual browser crashes or instability when visiting specific websites
• Unexpected child processes spawned from browser processes
• Memory access violations or heap corruption errors in browser crash logs
• Suspicious XSLT processing activities in browser debugging logs

Detection Strategies

• Monitor for abnormal browser behavior including unexpected crashes related to XSLT processing
• Implement web filtering to block access to known malicious domains hosting exploit content
• Deploy endpoint detection solutions capable of identifying heap spray and memory corruption exploitation techniques
• Use browser sandboxing features and ensure they are properly configured

Monitoring Recommendations

• Review browser crash reports for patterns indicating heap corruption or Use After Free exploitation attempts
• Monitor network traffic for connections to suspicious domains known to host browser exploits
• Track browser version deployments across the organization to identify unpatched instances
• Enable enhanced browser logging for security events and XSLT processing anomalies

How to Mitigate CVE-2021-30560

Immediate Actions Required

• Update Google Chrome to version 91.0.4472.164 or later immediately
• Update libxslt to the latest patched version across all affected systems
• Apply vendor-specific patches for Debian Linux and Splunk Universal Forwarder
• Review and restrict access to untrusted websites that could host exploit content

Patch Information

Google has released a security update addressing this vulnerability in Chrome version 91.0.4472.164. Organizations should ensure all Chrome installations are updated to this version or later. Detailed information about this update is available in the Google Chrome Update Announcement.

For Debian Linux systems, security advisories have been released including Debian DSA-5216 and Debian LTS Security Announcement. Gentoo users should refer to GLSA #202310-23 for patching guidance.

Organizations using Splunk Universal Forwarder should consult Splunk's security advisories and update to a patched version that addresses the underlying libxslt vulnerability.

Workarounds

• Consider disabling XSLT processing in browsers if not required for business operations
• Implement strict content security policies (CSP) to limit execution of untrusted content
• Use browser isolation technologies to separate browsing sessions from critical systems
• Deploy web application firewalls (WAF) to filter potentially malicious XSLT content

# Verify Chrome version on Linux/macOS
google-chrome --version
# Should show version 91.0.4472.164 or higher

# Check libxslt version on Debian-based systems
apt-cache policy libxslt1.1
# Ensure the installed version includes the security patch