CVE-2021-30560: 
vulnerability analysis and mitigation

Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. The vulnerability was discovered on June 12, 2021, and was assigned CVE-2021-30560. The issue affects Google Chrome browsers and libxslt library implementations (NVD, Chrome Blog).

The vulnerability is classified as a Use-After-Free (UAF) issue in the Blink XSLT component, specifically in the xsltApplyTemplates function. It has been assigned a CVSS v3.1 base score of 8.8 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability allows potential heap corruption exploitation through specially crafted HTML pages (NVD).

If successfully exploited, this vulnerability could lead to heap corruption, potentially resulting in arbitrary code execution. The high CVSS score indicates significant potential impact on confidentiality, integrity, and availability of the affected systems when exploited (NVD).

The vulnerability requires user interaction and can be exploited remotely through a crafted HTML page. The attack complexity is considered low, requiring no special privileges for exploitation (NVD).

The vulnerability has been patched in Google Chrome version 91.0.4472.164 and libxslt version 1.1.35. Users are advised to upgrade to these or later versions. For libxslt, various Linux distributions have also released security updates, including Debian (version 1.1.34-4+deb11u1) and Ubuntu (Debian Security, Chrome Blog).