CVE-2021-37976: Google Chromium Information Disclosure Vulnerability
Vulnerability summary
CVE-2021-37976 is a medium (CVSS 6.5) Missing Authorization vulnerability in Google Chromium. It is known to be exploited: CISA lists it, first on 03-11-2021. EPSS estimates a 19.90% chance of exploitation in the next 30 days, higher than 97.4% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 9 · Related 8Timeline
- 08-10-2021PublishedVulnerability first disclosed.
- 03-11-2021Added to CISA KEVGoogle Chromium Information Disclosure Vulnerability
- 17-11-2021CISA remediation dueApply updates per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS trend
Probability
19.90%
Chance of exploitation in the next 30 days
Percentile
97%
Versus all other CVEs
30-day change
+0.15 pp
From 19.75% on 19-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 03-11-2021
- Federal due date
- 17-11-2021
CISA required action
Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2021-37976
Public exploits
1 foundExploit Reference (crbug.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Debian2 products
- chromium< 97.0.4692.71-0.1
- debian_linuxEOL10.0 | 11.0
Fedoraproject1 product
- fedoraEOL33 | 34 | 35
Google1 product
- chrome≥ unspecified, < 94.0.4606.71 | < 94.0.4606.71
Ubuntu1 product
- chromium-browser< 94.0.4606.71-0ubuntu0.18.04.1
4 vendors · 5 products
References
11 links- chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_30.htmlX Refsource MISCRelease Notes
www.debian.org/security/2022/dsa-5046Vendor AdvisoryX Refsource DEBIANMailing ListThird Party Advisory- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-37976Government ResourceUS Government Resource