Vulnerability record · CVE-2021-37976 · published 8 October 2021
CVE-2021-37976: Google Chrome memory implementation information disclosure
Google · Chrome
Google Chrome before 94.0.4606.71 contains an inappropriate implementation in Memory that lets a remote attacker read potentially sensitive information from process memory. The flaw is a missing authorization weakness (CWE-862) reachable through a crafted HTML page, and it was added to CISA's Known Exploited Vulnerabilities catalog, so it has seen real-world exploitation.
Description
Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Automated analysis
high priorityConfidentiality impact is high and the flaw is in CISA KEV with a high EPSS percentile, though the CVSS base score is only 6.5 and exploitation requires user interaction.
What it is
Google Chrome before 94.0.4606.71 contains an inappropriate implementation in Memory that lets a remote attacker read potentially sensitive information from process memory. The flaw is a missing authorization weakness (CWE-862) reachable through a crafted HTML page, and it was added to CISA's Known Exploited Vulnerabilities catalog, so it has seen real-world exploitation.
Impact
An attacker can obtain potentially sensitive information from process memory, which may expose data such as credentials, tokens or other in-process secrets. There is no integrity or availability impact; the loss is confidentiality only.
Attack surface
Reached over the network by getting a victim to load a crafted HTML page in Chrome, so user interaction is required and no authentication is needed (CVSS vector AV:N/AC:L/PR:N/UI:R). The record does not describe the exact memory-handling path beyond the crafted page.
Exploitation
Listed in CISA KEV with a due date of 2021-11-17, and references include an Exploit-tagged Chromium issue, indicating known exploitation. EPSS is 0.19748 (97.3rd percentile), a high relative likelihood score.
What to do
- Update Chrome to 94.0.4606.71 or later, and apply the corresponding Fedora and Debian security updates.
- Track the CISA KEV due date and confirm remediation across all managed endpoints and browsers.
- Enforce browser auto-update or rapid patch cycles for Chromium-based browsers.
- Reduce exposure by restricting untrusted web content and limiting high-value secrets held in browser process memory.
Detection
- Inventory Chrome and Chromium-based browser versions and flag any below 94.0.4606.71.
- Monitor for exploitation attempts or unusual process-memory access patterns tied to browser activity.
- Review proxy and web logs for delivery of crafted HTML pages to vulnerable browser versions.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2021-37976 to the Known Exploited Vulnerabilities catalog on 3 November 2021 as "Google Chromium Information Disclosure Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 17 November 2021.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2021-37976 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-37976), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
