CVE-2021-21181: 
vulnerability analysis and mitigation

Side-channel information leakage in autofill in Google Chrome prior to version 89.0.4389.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. The vulnerability was discovered by Xu Lin, Panagiotis Ilia, and Jason Polakis from the University of Illinois at Chicago (Chrome Release).

The vulnerability is tracked as CVE-2021-21181 and has been assigned a CVSS v3.1 base score of 6.5 (Medium). The attack vector is network-based, with low attack complexity and requires user interaction. The scope is unchanged, with high confidentiality impact but no impact on integrity or availability (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) (NVD).

The vulnerability could allow an attacker to obtain potentially sensitive information from process memory through a side-channel attack targeting the browser's autofill feature. This could potentially expose user data that is stored in the browser's memory (Debian Security).

The vulnerability requires user interaction and can be exploited remotely through a crafted HTML page. No evidence of active exploitation in the wild was reported at the time of disclosure (NVD).

The vulnerability was fixed in Google Chrome version 89.0.4389.72. Users are advised to update to this version or later. Multiple Linux distributions have also released security updates to address this vulnerability, including Debian (89.0.4389.114-1~deb10u1), Fedora, and Gentoo (Debian Security, Gentoo Security).