CVE-2021-37973: critical vulnerability in Google Chrome
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
A memory flaw in Chrome's Portals feature lets attackers use freed memory to escape the browser's security sandbox. An attacker with control over the webpage's rendering process can exploit this to gain full system access.
Use-after-free vulnerability in Chrome Portals API (CWE-416) allows a compromised renderer process to access deallocated memory objects. Exploitation requires crafted HTML and renderer compromise, enabling sandbox escape with full system execution privileges.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.