CVE-2021-37977: Use after free in Garbage Collection
Use after free in Garbage Collection in Google Chrome prior to 94.0.4606.81 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 94.0.4606.81 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to induce a user to load a crafted HTML page. The CVSS vector indicates the attack can be delivered remotely, requires no privileges, and requires user interaction.
Which Chrome versions are affected?
Google Chrome versions prior to 94.0.4606.81 are affected. The listed software also includes Debian Linux, Debian's chromium package, and Fedora.
What is the impact of successful exploitation?
Successful exploitation may allow heap corruption. The CVSS rating indicates potential high impact to confidentiality, integrity, and availability.