CVE-2021-37973
Google Chromium Portals Use-After-Free Vulnerability
Description
CVE-2021-37973 is a critical-severity vulnerability affecting Google Chromium Portals. Google Chromium Portals contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page. This vulnerability affects web browsers that utilize Chromium, including Google Chrome and Microsoft Edge. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 12.63% (93.9th percentile), this vulnerability demonstrates a high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 94.0.4606.61 | |
| fedoraproject | fedora | 33; 35 |
| debian | debian linux | 10.0; 11.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
References
- https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_24.html(Release Notes)
- https://crbug.com/1251727(Issue Tracking, Patch, Vendor Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R/(Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PM7MOYYHJSWLIFZ4TPJTD7MSA3HSSLV2/(Release Notes)
- https://www.debian.org/security/2022/dsa-5046(Mailing List, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-37973(US Government Resource)
Weakness Type
CWE-416: Use After Free
Use After Free (UAF) is a vulnerability that occurs when software continues to use a pointer after the memory it references has been freed. Once memory is freed, it may be reallocated for other purposes. If the dangling pointer is subsequently dereferenced, the program may read or write to memory now used for different data structures, leading to data corruption, information disclosure, or code execution. Use-after-free vulnerabilities are particularly prevalent in complex applications with manual memory management, including browsers, document parsers, and operating system kernels.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2021-37973 carries a CVSS 3.1 score of 9.6 (CRITICAL), indicating a maximum-severity threat. The vulnerability is exploitable over the network with low attack complexity and requires no authentication, though user interaction is needed. Successful exploitation can severely compromise data confidentiality, allow unauthorized modification of data and systems, and cause complete service disruption. The scope is changed, meaning exploitation can impact resources beyond the vulnerable component itself, amplifying the overall damage. Organizations running affected deployments face significant operational risk if this vulnerability remains unpatched.
Exploit Maturity
CVE-2021-37973 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 12.63% (93.9th percentile) indicates a high probability of exploitation. Public exploit references are available, which lowers the barrier for attackers and increases the urgency of remediation. Federal agencies were required to remediate this vulnerability by 2021-11-17 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions.
- Verify that all instances of affected products (google chrome (< 94.0.4606.61), fedoraproject fedora (33; 35), debian debian linux (10.0; 11.0)) have been updated to patched versions.
- If immediate patching is not possible, restrict network access to affected systems using firewall rules and network segmentation to limit exposure.
- Monitor systems for indicators of compromise, including unusual process activity, unexpected network connections, and unauthorized configuration changes.
- Review security logs and conduct threat hunting to determine if the vulnerability was exploited prior to patching.
Technical Details
CVE-2021-37973 affects Google Chromium Portals. Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. The attack vector is network-based, meaning an attacker can exploit this vulnerability remotely without physical access to the target system. The CVSS score of 9.6 reflects the combination of easy exploitability and severe impact across confidentiality, integrity, and availability.
Frequently Asked Questions
Is CVE-2021-37973 being actively exploited?
Yes. CVE-2021-37973 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 12.63% (93.9th percentile) further indicates a high exploitation probability.
What products are affected by CVE-2021-37973?
CVE-2021-37973 affects Google Chromium Portals. Specifically affected products include: google chrome (< 94.0.4606.61), fedoraproject fedora (33; 35), debian debian linux (10.0; 11.0).
How do I fix CVE-2021-37973?
Apply updates per vendor instructions. Ensure all affected systems are updated to the latest patched versions. If patching is not immediately possible, implement network-level mitigations to limit exposure.
How severe is CVE-2021-37973?
CVE-2021-37973 has a CVSS 3.1 score of 9.6 (CRITICAL). This is a critical-severity vulnerability that requires immediate attention and remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.