Actively exploited · Published Oct 8, 2021 · Assigned by Chrome
CVE-2021-37973
Critical 9.6 Exploited
In plain English
A critical-severity use-after-free in Chrome from Google. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 11.7% (higher than 96% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Nov 17, 2021.
Official description
Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | qt5-qtwebengine | 5.15.3_git20211006-r3 | ALPINE-CVE-2021-37973 |
| Alpine:v3.21 | qt5-qtwebengine | 5.15.3_git20211006-r3 | ALPINE-CVE-2021-37973 |
| Alpine:v3.22 | qt5-qtwebengine | 5.15.3_git20211006-r3 | ALPINE-CVE-2021-37973 |
| Alpine:v3.23 | qt5-qtwebengine | 5.15.3_git20211006-r3 | ALPINE-CVE-2021-37973 |
| Debian:12 | chromium | 97.0.4692.71-0.1 | DEBIAN-CVE-2021-37973 |
| Debian:13 | chromium | 97.0.4692.71-0.1 | DEBIAN-CVE-2021-37973 |
| Debian:14 | chromium | 97.0.4692.71-0.1 | DEBIAN-CVE-2021-37973 |
Affected products (as reported)
Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://crbug.com/1251727 x_refsource_MISC
- https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_24.html x_refsource_MISC
- FEDORA-2021-ab09a05562 vendor-advisory, x_refsource_FEDORA
- FEDORA-2021-591b3a2af0 vendor-advisory, x_refsource_FEDORA
- DSA-5046 vendor-advisory, x_refsource_DEBIAN
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-37973 government-resource