CVE-2021-37976
Google Chromium Information Disclosure Vulnerability
Description
CVE-2021-37976 is a MEDIUM information disclosure vulnerability in Google Chromium's core memory component, carrying a CVSS 3.1 score of 6.5. The vulnerability allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. This flaw affects multiple web browsers that utilize Chromium, including Google Chrome, Microsoft Edge, and Opera. Affected products include Google Chrome (< 94.0.4606.71), Fedora (33; 34; 35), and Debian Linux (10.0; 11.0). This CVE is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of 2021-11-17. With an EPSS score of 0.14567 (94.36th percentile), this vulnerability demonstrates significant real-world exploitation activity and should be prioritized for remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 94.0.4606.71 | |
| fedoraproject | fedora | 33; 34; 35 |
| debian | debian linux | 10.0; 11.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
References
- https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_30.html(Release Notes)
- https://crbug.com/1251787(Exploit, Issue Tracking, Vendor Advisory)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/D63JZ3ROXCUHP4CFWDHCPZNTGET7T34R/(Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FRFXUDH46PFVE75VQVWY6PYY5DK3S2XT/(Release Notes)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RNARCF5HEZK7GJXZRN5TQ45AQDCRM2WO/(Release Notes)
- https://www.debian.org/security/2022/dsa-5046(Mailing List, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-37976(US Government Resource)
Weakness Type
CWE-862: Missing Authorization
CVE-2021-37976 is classified under CWE-862 — Missing Authorization. This weakness occurs when a software component does not perform an authorization check when an actor attempts to access a resource or perform an action. Without proper authorization checks, an attacker may be able to access sensitive data or perform privileged operations that should be restricted. Missing authorization vulnerabilities are particularly dangerous because they can allow attackers to bypass access controls silently, without triggering authentication failures or obvious errors.
In the context of Google Chromium's memory component, this weakness is concerning because it enables attackers to read process memory contents that should be protected. By exploiting the inappropriate implementation in Chrome's memory handling, an attacker can extract sensitive data from the browser process, potentially including credentials, session tokens, or other confidential information stored in memory during normal browsing activity.
Learn more: CWE-862 — Missing Authorization
Impact Analysis
CVE-2021-37976 carries a CVSS 3.1 score of 6.5 (MEDIUM) with Unchanged Scope.
Confidentiality (HIGH): Successful exploitation allows the attacker to obtain potentially sensitive information from process memory, including session data, credentials, or other confidential information that the browser processes during normal operation.
Integrity (NONE): This vulnerability does not allow modification of data or system files. The attack is purely information disclosure in nature.
Availability (NONE): Exploitation does not cause service disruption or denial of service. The affected system continues to operate normally during and after the attack.
Scope Unchanged: The vulnerability's impact is contained within the Chromium browser process. While sensitive data can be disclosed, the attacker cannot use this vulnerability alone to escape the browser sandbox or affect other system components.
With an EPSS score of 0.14567 (94.36th percentile), this vulnerability ranks among the most likely to be exploited in real-world attacks, underscoring the urgency of remediation despite its medium severity rating.
Exploit Maturity
CVE-2021-37976 has confirmed active exploitation in the wild and is listed in CISA's Known Exploited Vulnerabilities catalog.
Exploit status: This vulnerability has been actively exploited, as confirmed by its inclusion in the KEV catalog. Google's Threat Analysis Group (TAG) reported this vulnerability as being used in the wild. The EPSS score of 0.14567 (94.36th percentile) confirms significant real-world exploitation probability.
Ransomware association: As of the latest KEV data, no direct ransomware association has been confirmed for CVE-2021-37976. However, information disclosure vulnerabilities are commonly used as part of exploit chains that lead to full system compromise.
Attack surface: This vulnerability was discovered being used in targeted attacks and is often chained with other Chromium vulnerabilities (such as CVE-2021-37975) to achieve full code execution. While this CVE alone provides information disclosure, when combined with memory corruption vulnerabilities it enables reliable exploitation.
KEV deadline: CISA required federal agencies to remediate this vulnerability by 2021-11-17. All organizations should treat this deadline as a strong recommendation for their own remediation timelines.
Remediation
- Apply vendor patches immediately. Update Google Chrome to version 94.0.4606.71 or later. Consult the vendor advisory at chromereleases.googleblog.com for specific patch guidance.
- Verify affected product versions in your environment. Identify all instances of Chromium-based browsers in your infrastructure, including Google Chrome (< 94.0.4606.71), Microsoft Edge, and Opera. Use asset inventory and vulnerability scanning tools to ensure no instances are missed.
- Update all Chromium-based browsers. Since this vulnerability affects the Chromium engine, ensure all browsers built on Chromium in your environment are updated to versions that include the fix.
- Implement interim mitigations if patching is delayed. If immediate patching is not feasible, apply network-level controls such as restricting access to untrusted websites, enabling enhanced logging, and monitoring for indicators of compromise.
- Scan for signs of prior exploitation. Given the confirmed active exploitation of this vulnerability, review system logs and security monitoring data for evidence of compromise. Investigate any unusual memory access patterns or data exfiltration indicators.
- Update detection signatures and monitoring rules. Ensure intrusion detection systems, endpoint detection tools, and SIEM rules are updated to detect exploitation attempts targeting CVE-2021-37976.
Technical Details
CVE-2021-37976 is a MEDIUM-severity vulnerability in Google Chromium's core memory component that can be exploited remotely over the network. The attack complexity is low, meaning no specialized conditions or preparation are required beyond the attack prerequisites. No prior authentication or privileges are needed to initiate the attack. User interaction is required, meaning a victim must visit a malicious website or click a link leading to a crafted HTML page.
Technical mechanism: The vulnerability stems from an inappropriate implementation in Google Chrome's memory component. The flaw allows an attacker to craft a malicious HTML page that, when visited by a victim, triggers the browser to leak sensitive information from its process memory. This information disclosure occurs because the memory component fails to properly enforce authorization checks on memory access operations, allowing cross-origin or unauthorized data to be exposed to the attacker.
Affected products: Google Chrome (< 94.0.4606.71), Fedoraproject Fedora (33; 34; 35), Debian Debian Linux (10.0; 11.0)
CVSS 3.1 vector analysis: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N reflects a network-based attack with low complexity, no privileges required, user interaction required, unchanged scope, and high confidentiality impact with no integrity or availability impact.
Frequently Asked Questions
Is CVE-2021-37976 being actively exploited?
Yes, CVE-2021-37976 is actively exploited in the wild. Google's Threat Analysis Group (TAG) identified this vulnerability as being used in targeted attacks, and it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. The EPSS score of 0.14567 (94.36th percentile) confirms significant real-world exploitation probability.
Which products are affected by CVE-2021-37976?
The primary affected product is Google Chrome versions prior to 94.0.4606.71. Since the vulnerability is in the Chromium engine, other Chromium-based browsers including Microsoft Edge and Opera may also be affected. Linux distributions including Fedora (33, 34, 35) and Debian Linux (10.0, 11.0) that ship Chromium packages are also impacted.
How do I fix CVE-2021-37976?
Update Google Chrome to version 94.0.4606.71 or later. For other Chromium-based browsers, apply the corresponding vendor updates. For Linux distributions, install the latest Chromium security updates from your distribution's package repositories. Verify all instances are patched using vulnerability scanning.
How severe is CVE-2021-37976?
CVE-2021-37976 is rated MEDIUM with a CVSS 3.1 score of 6.5. While the severity rating is moderate, the confirmed active exploitation and its use in exploit chains with other vulnerabilities make it critical to remediate promptly. The CISA remediation deadline was 2021-11-17.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.