Google Chrome Portals Use-After-Free Sandbox Escape and Remote Code Execution (CVE-2021-37973)

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2021-37973) is a Use-After-Free (UAF) flaw residing within the 'Portals' component of Google Chrome. Portals is an experimental navigation and page-embedding feature designed to allow seamless transitions and pre-rendering. Due to improper object lifecycle management, certain objects within the Portals implementation are destroyed while active pointers to them are still retained. This dangling pointer condition allows an attacker to reuse the freed memory space, leading to memory corruption.

2. Exploitation Mechanics & Attack Scenario

To exploit this vulnerability, an attacker must first compromise the renderer process (e.g., via a separate renderer vulnerability or malicious script execution). Once renderer-level execution is achieved, the attacker coaxes the victim into loading a specially crafted HTML page. By manipulating the creation and destruction of Portals objects via JavaScript, the attacker triggers the UAF condition, populating the freed heap memory with controlled payloads. When the browser attempts to reference the stale pointer, control flow is hijacked, enabling the attacker to escape the Chrome sandbox and execute arbitrary code with the privileges of the browser process.

3. Infrastructure & Business Impact

With a CVSS 3.1 score of 9.6 (Critical), this vulnerability poses a severe threat and has been actively exploited in the wild, leading to its inclusion in the CISA KEV catalog. Successful exploitation allows complete compromise of the user's endpoint without requiring administrative privileges or significant user interaction beyond visiting a malicious site. In an enterprise environment, this can serve as an initial access vector for lateral movement, ransomware deployment, and sensitive data exfiltration.