Actively exploited · Published Oct 8, 2021 · Assigned by Chrome

CVE-2021-37976

Medium 6.5 Exploited

In plain English

A medium-severity missing authorization in Chrome from Google. Attackers are actively exploiting it in the wild (listed by CISA on November 3, 2021). The chance it is exploited in the next 30 days is estimated at 19.9% (higher than 97% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)19.9%top 2.6% of all CVEs

Exploited in the wildYesCISA KEV since Nov 3, 2021

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Nov 17, 2021.

Official description

Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	chromium	97.0.4692.71-0.1	DEBIAN-CVE-2021-37976
Debian:13	chromium	97.0.4692.71-0.1	DEBIAN-CVE-2021-37976
Debian:14	chromium	97.0.4692.71-0.1	DEBIAN-CVE-2021-37976

Affected products (as reported)

Vendor	Product	Versions
Google	Chrome	unspecified – before 94.0.4606.71

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

References

https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_30.html x_refsource_MISC
https://crbug.com/1251787 x_refsource_MISC
FEDORA-2021-116eff380f vendor-advisory, x_refsource_FEDORA
FEDORA-2021-5ffabdc080 vendor-advisory, x_refsource_FEDORA
FEDORA-2021-5093f11905 vendor-advisory, x_refsource_FEDORA
DSA-5046 vendor-advisory, x_refsource_DEBIAN
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-37976 government-resource