CVE-2021-37976

A remote attacker could extract sensitive data from Chromium browser processes via a crafted HTML page due to an unpatched memory disclosure flaw.

This information disclosure vulnerability in Chromium allows remote attackers to read sensitive data from browser memory, impacting any DIB organization relying on Chromium-based browsers like Chrome or Edge. The flaw was actively exploited in the wild and remains unpatched in older versions, representing a clear negligence failure in patch management. Organizations must enforce strict browser patching and consider alternative browsers for high-assurance environments.

Shame score — The vulnerability was actively exploited in the wild and remained unpatched for a significant period, demonstrating a failure in timely patch management and leaving systems exposed to data exfiltration.