Vulnerability record · CVE-2021-37973 · published 8 October 2021
CVE-2021-37973: Google Chrome Portals use-after-free enables sandbox escape
Google · Chrome
CVE-2021-37973 is a use-after-free flaw in the Portals component of Google Chrome prior to 94.0.4606.61. A remote attacker who has already compromised the renderer process can trigger the bug via a crafted HTML page to escape the browser sandbox. Because it allows a renderer compromise to become a full browser compromise, it is a high-value chaining vulnerability.
Description
Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.6, CISA KEV listing, and a sandbox escape that escalates a renderer compromise make this a critical patching priority.
What it is
CVE-2021-37973 is a use-after-free flaw in the Portals component of Google Chrome prior to 94.0.4606.61. A remote attacker who has already compromised the renderer process can trigger the bug via a crafted HTML page to escape the browser sandbox. Because it allows a renderer compromise to become a full browser compromise, it is a high-value chaining vulnerability.
Impact
An attacker who already controls the renderer process can break out of the Chrome sandbox and execute code with the privileges of the browser process. This turns a renderer-only compromise into a full system compromise on the host.
Attack surface
Reached over the network through a crafted HTML page rendered in Chrome, requiring user interaction to load the page. The attacker must first have compromised the renderer process, so this is not a standalone remote code execution path.
Exploitation
CVE-2021-37973 is listed in CISA KEV with a due date of 2021-11-17, indicating known exploitation, and EPSS shows a 30-day probability of 0.11641 (95.8th percentile). No ransomware campaign use is documented.
What to do
- Update Google Chrome to 94.0.4606.61 or later, and apply the corresponding Fedora and Debian updates.
- Enforce automatic browser updates and verify installed versions across endpoints.
- Restrict or disable the Portals feature where feasible until patching is complete.
- Treat renderer compromise as a sandbox-escape risk and harden browser isolation controls.
Detection
- Monitor for Chrome versions below 94.0.4606.61 in asset inventories.
- Hunt for crashes or abnormal behavior in the Chrome renderer and Portals component.
- Correlate renderer process compromise indicators with subsequent browser process activity.
- Alert on exploitation attempts or known exploit artifacts tied to CVE-2021-37973.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2021-37973 to the Known Exploited Vulnerabilities catalog on 3 November 2021 as "Google Chromium Portals Use-After-Free Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 17 November 2021.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2021-37973 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-37973), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
