CVE-2021-37993: 
vulnerability analysis and mitigation

Use after free vulnerability (CVE-2021-37993) was discovered in PDF Accessibility component of Google Chrome versions prior to 95.0.4638.54. The vulnerability was reported by Cassidy Kim of Amber Security Lab, OPPO Mobile Telecommunications Corp. Ltd. on October 2, 2021 (Chrome Release).

The vulnerability is classified as a Use After Free (CWE-416) issue in the PDF Accessibility component. It received a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, no privileges required, and user interaction required (NVD).

If successfully exploited, this vulnerability could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page, potentially leading to arbitrary code execution with the same privileges as the Chrome browser process (NVD).

Google addressed this vulnerability in Chrome version 95.0.4638.54. Users and administrators should update to this version or later to mitigate the risk. The fix was also backported to various Linux distributions, including Debian which addressed it in version 97.0.4692.71-0.1~deb11u1 (Debian Advisory).