CVE-2021-37993: Use after free in PDF Accessibility

Reference Links

• https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_19.html (Advisory)
• https://crbug.com/1255332
• https://www.debian.org/security/2022/dsa-5046
• https://security-tracker.debian.org/tracker/CVE-2021-37993

Parent vulnerabilities

(Appears in the following advisories)

• 53254084301211911

Peer vulnerabilities

(Found alongside the following vulnerabilities)

• CVE-2021-37981
• CVE-2021-37982
• CVE-2021-37983
• CVE-2021-37984
• CVE-2021-37985
• CVE-2021-37986
• CVE-2021-37987
• CVE-2021-37988
• CVE-2021-37989
• CVE-2021-37990
• CVE-2021-37991
• CVE-2021-37992
• CVE-2021-37996
• CVE-2021-37994
• CVE-2021-37995

Frequently Asked Questions

• What is CVE-2021-37993?

  CVE-2021-37993 is a vulnerability that allows a remote attacker to potentially exploit heap corruption in Google Chrome prior to version 95.0.4638.54 via a crafted HTML page.

• How does CVE-2021-37993 work?

  CVE-2021-37993 is a use after free vulnerability in PDF Accessibility in Google Chrome, which can lead to heap corruption when processing a specially crafted HTML page.

• What software versions are affected by CVE-2021-37993?

  Google Chrome versions prior to 95.0.4638.54 are affected by CVE-2021-37993.

• What is the severity of CVE-2021-37993?

  The severity of CVE-2021-37993 is not specified.

• How can I fix CVE-2021-37993?

  To fix CVE-2021-37993, update Google Chrome to version 95.0.4638.54 or later.