CVE-2021-37973VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2021-37973: Google Chromium Portals Use-After-Free Vulnerability

Affects Google Chromium PortalsSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 11/17/2021
EPSS: 11.7% chance of exploitation in 30 days – higher than 96% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2021-37973 (opens in a new tab)

Description

CVE-2021-37973 is a use-after-free vulnerability in Google Chromium Portals that can be exploited by a remote attacker who has compromised the renderer process. This flaw potentially allows sandbox escape via a crafted HTML page. It affects Chromium-based web browsers such as Google Chrome and Microsoft Edge. The vulnerability has been exploited in the wild.

Summary

Google Chromium Portals contains a use-after-free vulnerability (CWE-416) that enables a remote attacker, with control over the renderer process, to potentially escape the browser sandbox by delivering a specially crafted HTML page. This vulnerability impacts web browsers built on Chromium, including Google Chrome and Microsoft Edge. Exploitation of this vulnerability has been observed in the wild, indicating active threat usage.

Impact

Successful exploitation can allow an attacker who has compromised the renderer process to escape the sandbox, potentially leading to elevated privileges or further system compromise beyond the browser sandbox restrictions. This increases the risk of broader system impact from a browser-based attack.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply general security best practices and monitor vendor communications for updates. No vendor advisory or patch link is provided in the current data.

Weaknesses

CWE-416Use After Free (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:26:02 UTC

Weaknesses

References

Related threats