CVE-2021-30528

Name	CVE-2021-30528
Description	Use after free in WebAuthentication in Google Chrome on Android prior to 91.0.4472.77 allowed a remote attacker who had compromised the renderer process of a user who had saved a credit card in their Google account to potentially exploit heap corruption via a crafted HTML page.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium
Debian Bugs	990079

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
chromium (PTS)	stretch (security), stretch	73.0.3683.75-1~deb9u1	vulnerable
	buster	89.0.4389.114-1~deb10u1	vulnerable
	buster (security)	90.0.4430.212-1~deb10u1	vulnerable
	bullseye, sid	90.0.4430.212-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
chromium	source	stretch	(unfixed)	end-of-life
chromium	source	(unstable)	(unfixed)			990079

[stretch] - chromium <end-of-life> (see DSA 4562)