CVE-2021-30522: 
vulnerability analysis and mitigation

CVE-2021-30522 is a use-after-free vulnerability discovered in the WebAudio component of Google Chrome prior to version 91.0.4472.77. The vulnerability was reported by Piotr Bania of Cisco Talos on February 9, 2021, and was publicly disclosed in May 2021 (Chrome Release).

The vulnerability exists in the WebAudio blink::AudioNodeOutput::Pull functionality of Google Chrome. The issue occurs when an already freed memory region (AudioBus pointer) is provided to the AudioNodeOutput::Pull function, leading to a use-after-free condition. The vulnerability received a CVSS v3.1 base score of 8.8 HIGH (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is classified as CWE-416 (Use After Free) (NVD, Talos).

A successful exploitation of this vulnerability could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page, potentially leading to arbitrary code execution, information disclosure, or denial of service (NVD, Gentoo).

The vulnerability can be triggered when a user visits a specially crafted malicious web page. The exploit requires user interaction and can be achieved through javascript utilizing indirect calling procedures like setInterval, setTimeout, or meta refresh to cause the use-after-free condition (Talos).

The vulnerability was patched in Google Chrome version 91.0.4472.77. Users and administrators are advised to upgrade to this version or later. Various Linux distributions also released security updates to address this vulnerability, including Fedora and Gentoo (Chrome Release, Fedora, Gentoo).