CVE-2021-37964
Inappropriate implementation in ChromeOS Networking in Google Chrome on ChromeOS prior to 94.0...
3.3 LowFix available
Inappropriate implementation in ChromeOS Networking in Google Chrome on ChromeOS prior to 94.0.4606.54 allowed an attacker with a rogue wireless access point to to potentially carryout a wifi impersonation attack via a crafted ONC file.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
0.52%Down 0.3 points since Oct 9, 2021
What each source reports
NVD Score used
Inappropriate implementation in ChromeOS Networking in Google Chrome on ChromeOS prior to 94.0.4606.54 allowed an attacker with a rogue wireless access point to to potentially carryout a wifi impersonation attack via a crafted ONC file.
- Record
CVE-2021-37964- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
Inappropriate implementation in ChromeOS Networking in Google Chrome on ChromeOS prior to 94.0.4606.54 allowed an attacker with a rogue wireless access point to to potentially carryout a wifi impersonation attack via a crafted ONC file.
- Record
CVE-2021-37964- Updated
- 2026-11-02
EUVDEUVD-2021-24437 No score
Inappropriate implementation in ChromeOS Networking in Google Chrome on ChromeOS prior to 94.0.4606.54 allowed an attacker with a rogue wireless access point to to potentially carryout a wifi impersonation attack via a crafted ONC file.
- Record
EUVD-2021-24437- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-65w8-mf96-wpcm No score
Inappropriate implementation in ChromeOS Networking in Google Chrome on ChromeOS prior to 94.0...
Inappropriate implementation in ChromeOS Networking in Google Chrome on ChromeOS prior to 94.0.4606.54 allowed an attacker with a rogue wireless access point to to potentially carryout a wifi impersonation attack via a crafted ONC file.
- Record
GHSA-65w8-mf96-wpcm- Updated
- 2026-11-02
OSV
Inappropriate implementation in ChromeOS Networking in Google Chrome on ChromeOS prior to 94.0.4606.54 allowed an attacker with a rogue wireless access point to to potentially carryout a wifi impersonation attack via a crafted ONC file.
- Record
CVE-2021-37964- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-37964
Inappropriate implementation in ChromeOS Networking in Google Chrome on ChromeOS prior to 94.0.4606.54 allowed an attacker with a rogue wireless access point to to potentially carryout a wifi impersonation attack via a crafted ONC file.
- Record
DEBIAN-CVE-2021-37964- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
Show 5 moreShow less
OSVUBUNTU-CVE-2021-37964
Inappropriate implementation in ChromeOS Networking in Google Chrome on ChromeOS prior to 94.0.4606.54 allowed an attacker with a rogue wireless access point to to potentially carryout a wifi impersonation attack via a crafted ONC file.
- Record
UBUNTU-CVE-2021-37964- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1339-1 No score
Security update for chromium
This update for chromium fixes the following issues:
Chromium 94.0.4606.54 (boo#1190765):
- CVE-2021-37956: Use after free in Offline use
- CVE-2021-37957: Use after free in WebGPU
- CVE-2021-37958: Inappropriate implementation in Navigation
- CVE-2021-37959: Use after free in Task Manager
- CVE-2021-37960: Inappropriate implementation in Blink graphics
- CVE-2021-37961: Use after free in Tab Strip
- CVE-2021-37962: Use after free in Performance Manager
- CVE-2021-37963: Side-channel information leakage in DevTools
- CVE-2021-37964: Inappropriate implementation in ChromeOS Networking
- CVE-2021-37965: Inappropriate implementation in Background Fetch API
- CVE-2021-37966: Inappropriate implementation in Compositing
- CVE-2021-37967: Inappropriate implementation in Background Fetch API
- CVE-2021-37968: Inappropriate implementation in Background Fetch API
- CVE-2021-37969: Inappropriate implementation in Google Updater
- CVE-2021-37970: Use after free in File System API
- CVE-2021-37971: Incorrect security UI in Web Browser UI
- CVE-2021-37972: Out of bounds read in libjpeg-turbo
Chromium 94.0.4606.61 (boo#1191166):
- CVE-2021-37973: Use after free in Portals
Chromium 94.0.4606.71 (boo#1191204):
- CVE-2021-37974 : Use after free in Safe Browsing
- CVE-2021-37975 : Use after free in V8
- CVE-2021-37976 : Information leak in core
- Record
openSUSE-SU-2021:1339-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1350-1 No score
Security update for chromium
This update for chromium fixes the following issues:
Chromium 94.0.4606.81 (boo#1191463):
- CVE-2021-37977: Use after free in Garbage Collection
- CVE-2021-37978: Heap buffer overflow in Blink
- CVE-2021-37979: Heap buffer overflow in WebRTC
- CVE-2021-37980: Inappropriate implementation in Sandbox
Chromium 94.0.4606.54 (boo#1190765):
- CVE-2021-37956: Use after free in Offline use
- CVE-2021-37957: Use after free in WebGPU
- CVE-2021-37958: Inappropriate implementation in Navigation
- CVE-2021-37959: Use after free in Task Manager
- CVE-2021-37960: Inappropriate implementation in Blink graphics
- CVE-2021-37961: Use after free in Tab Strip
- CVE-2021-37962: Use after free in Performance Manager
- CVE-2021-37963: Side-channel information leakage in DevTools
- CVE-2021-37964: Inappropriate implementation in ChromeOS Networking
- CVE-2021-37965: Inappropriate implementation in Background Fetch API
- CVE-2021-37966: Inappropriate implementation in Compositing
- CVE-2021-37967: Inappropriate implementation in Background Fetch API
- CVE-2021-37968: Inappropriate implementation in Background Fetch API
- CVE-2021-37969: Inappropriate implementation in Google Updater
- CVE-2021-37970: Use after free in File System API
- CVE-2021-37971: Incorrect security UI in Web Browser UI
- CVE-2021-37972: Out of bounds read in libjpeg-turbo
Chromium 94.0.4606.61 (boo#1191166):
- CVE-2021-37973: Use after free in Portals
Chromium 94.0.4606.71 (boo#1191204):
- CVE-2021-37974 : Use after free in Safe Browsing
- CVE-2021-37975 : Use after free in V8
- CVE-2021-37976 : Information leak in core
- Record
openSUSE-SU-2021:1350-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11555-1 No score
chromedriver-94.0.4606.71-1.1 on GA media
These are all security issues fixed in the chromedriver-94.0.4606.71-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11555-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score
ungoogled-chromium-113.0.5672.92-1.1 on GA media
These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12948-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromiumDebian:12 |
before 97.0.4692.71-0.1 | 97.0.4692.71-0.1 |
chromiumDebian:13 |
before 97.0.4692.71-0.1 | 97.0.4692.71-0.1 |
chromiumDebian:14 |
before 97.0.4692.71-0.1 | 97.0.4692.71-0.1 |
chromiumDebian:11 From an advisory covering 123 CVEs |
before 97.0.4692.71-0.1~deb11u1, plus listed versions 90.0.4430.212-193.0.4577.82-1 |
97.0.4692.71-0.1~deb11u1 |
chromium-browserUbuntu:18.04:LTS |
before 94.0.4606.71-0ubuntu0.18.04.1, plus listed versions 61.0.3163.100-0ubuntu1.137862.0.3202.62-0ubuntu0.17.10.138062.0.3202.89-0ubuntu1.138662.0.3202.94-0ubuntu1.138863.0.3239.84-0ubuntu1 Show 45 moreShow less63.0.3239.108-0ubuntu164.0.3282.119-0ubuntu164.0.3282.140-0ubuntu164.0.3282.167-0ubuntu165.0.3325.146-0ubuntu165.0.3325.181-0ubuntu166.0.3359.139-0ubuntu0.18.04.366.0.3359.181-0ubuntu0.18.04.167.0.3396.99-0ubuntu0.18.04.168.0.3440.75-0ubuntu0.18.04.168.0.3440.106-0ubuntu0.18.04.169.0.3497.81-0ubuntu0.18.04.170.0.3538.67-0ubuntu0.18.04.170.0.3538.77-0ubuntu0.18.04.170.0.3538.110-0ubuntu0.18.04.171.0.3578.80-0ubuntu0.18.04.171.0.3578.98-0ubuntu0.18.04.172.0.3626.119-0ubuntu0.18.04.172.0.3626.121-0ubuntu0.18.04.173.0.3683.75-0ubuntu0.18.04.173.0.3683.86-0ubuntu0.18.04.174.0.3729.169-0ubuntu0.18.04.175.0.3770.90-0ubuntu0.18.04.175.0.3770.142-0ubuntu0.18.04.176.0.3809.87-0ubuntu0.18.04.176.0.3809.100-0ubuntu0.18.04.177.0.3865.90-0ubuntu0.18.04.178.0.3904.70-0ubuntu0.18.04.278.0.3904.97-0ubuntu0.18.04.178.0.3904.108-0ubuntu0.18.04.179.0.3945.79-0ubuntu0.18.04.179.0.3945.130-0ubuntu0.18.04.180.0.3987.87-0ubuntu0.18.04.180.0.3987.149-0ubuntu0.18.04.180.0.3987.163-0ubuntu0.18.04.181.0.4044.122-0ubuntu0.18.04.181.0.4044.138-0ubuntu0.18.04.183.0.4103.61-0ubuntu0.18.04.184.0.4147.105-0ubuntu0.18.04.185.0.4183.83-0ubuntu0.18.04.285.0.4183.121-0ubuntu0.18.04.186.0.4240.75-0ubuntu0.18.04.186.0.4240.198-0ubuntu0.18.04.187.0.4280.66-0ubuntu0.18.04.189.0.4389.82-0ubuntu0.18.04.1 |
94.0.4606.71-0ubuntu0.18.04.1 |
chromiumSUSE:Package Hub 15 SP3 From an advisory covering 21 CVEs |
before 94.0.4606.71-bp153.2.31.1 | 94.0.4606.71-bp153.2.31.1 |
chromiumopenSUSE:Leap 15.3 From an advisory covering 21 CVEs |
before 94.0.4606.71-bp153.2.31.1 | 94.0.4606.71-bp153.2.31.1 |
chromiumopenSUSE:Leap 15.2 From an advisory covering 25 CVEs |
before 94.0.4606.81-lp152.2.132.1 | 94.0.4606.81-lp152.2.132.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 21 CVEs |
before 94.0.4606.71-1.1 | 94.0.4606.71-1.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 2310 CVEs |
before 113.0.5672.92-1.1 | 113.0.5672.92-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-37964 is a low vulnerability (CVSS 3.3) in Google Chrome, published October 8, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in chromium 97.0.4692.71-0.1.
References
chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop_21.html
crbug.com/1203612
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4DDW7HAHTS3SDVXBQUY4SURELO5D4X7R
debian.org/security/2022/dsa-5046
nvd.nist.gov/vuln/detail/CVE-2021-37964
Show 194 moreShow less
github.com/advisories/GHSA-65w8-mf96-wpcm
security-tracker.debian.org/tracker/CVE-2021-37964
ubuntu.com/security/CVE-2021-37964
cve.org/CVERecord?id=CVE-2021-37964
lists.opensuse.org/archives/list/[email protected]/thread/GDJ2M5H37726GXT3YZBJRSXV3JYGN7CL
bugzilla.suse.com/1190765
suse.com/security/cve/CVE-2021-37956
This page doesn't list everything
Left out here: 7 versions and 2,128 references. The JSON record has them.