CVE-2021-37976: medium-severity vulnerability in Google Chrome
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
A flaw in Google Chrome's memory handling allowed attackers to access sensitive information from the browser's memory by crafting a malicious HTML page. This could expose passwords, tokens, or other private data.
CWE-862 (Improper Authorization/Missing Authorization). Remote attacker exploits improper memory access controls in Chrome's memory management subsystem via crafted HTML. Requires user to visit malicious page; impacts confidentiality of process memory contents. Fixed in Chrome 94.0.4606.71.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.