{"schemaVersion":3,"id":"CVE-2021-38003","aliases":["UBUNTU-CVE-2021-38003","DEBIAN-CVE-2021-38003"],"status":"published","duplicateOf":null,"title":"Google Chromium V8 Memory Corruption Vulnerability","description":"Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.","dates":{"published":"2021-11-23T21:30:31.000Z","modified":"2025-10-21T23:25:24.322Z","reserved":null,"kevAdded":["2021-11-03T00:00:00.000Z"],"kevDue":["2021-11-17T00:00:00.000Z"]},"cvss":{"headline":{"score":8.8,"severity":"high","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":7.2,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":7.2,"impact":9.8,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":8.8,"severity":"high","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","exploitability":null,"impact":null,"computed":false},{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":6.8,"severity":"medium","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.38573,"percentile":0.98568,"severity":"high","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.38573},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.38573,"percentile":0.98568}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.38573,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.38573,"percentile":0.98568}]},"kev":{"state":"listed","entries":[{"source":"cisa","sourceLabel":"CISA","dateAdded":"2021-11-03T00:00:00.000Z","dueDate":"2021-11-17T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Google Chromium V8 Memory Corruption Vulnerability","description":"Google Chromium V8 Engine has a bug in JSON.stringify, where the internal TheHole value can leak to script code, causing memory corruption. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2021-38003","label":"nvd.nist.gov/vuln/detail/CVE-2021-38003"}],"vendor":"Google","product":"Chromium V8","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}],"listedCount":1,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":true,"entry":{"source":"cisa","sourceLabel":"CISA","dateAdded":"2021-11-03T00:00:00.000Z","dueDate":"2021-11-17T00:00:00.000Z","requiredAction":"Apply updates per vendor instructions.","name":"Google Chromium V8 Memory Corruption Vulnerability","description":"Google Chromium V8 Engine has a bug in JSON.stringify, where the internal TheHole value can leak to script code, causing memory corruption. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.","notes":[{"type":"url","href":"https://nvd.nist.gov/vuln/detail/CVE-2021-38003","label":"nvd.nist.gov/vuln/detail/CVE-2021-38003"}],"vendor":"Google","product":"Chromium V8","ransomware":false,"ransomwareUse":"Unknown","exploitationType":null}},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_ED7B88A722469A74","name":"Exploit Reference (crbug.com)","source":"reference","url":"https://crbug.com/1263462","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-755","name":"Improper Handling of Exceptional Conditions","description":"The product does not handle or incorrectly handles an exceptional condition.","type":"weakness","status":"Incomplete","abstraction":"Class","likelihoodOfExploit":"Medium","url":"https://cwe.mitre.org/data/definitions/755.html"}],"affected":[{"vendor":"debian","product":"chromium","name":"chromium","label":"chromium","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/chromium","purlType":"deb","versions":[{"text":"< 97.0.4692.71-0.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 97.0.4692.71-0.1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"chromium-browser","name":"chromium-browser","label":"chromium-browser","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/chromium-browser","purlType":"deb","versions":[{"text":"< 95.0.4638.69-0ubuntu0.18.04.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 95.0.4638.69-0ubuntu0.18.04.1","eol":null,"hubHref":null},{"vendor":"debian","product":"debian_linux","name":"debian linux","label":"debian_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"10.0","noFixRecorded":false,"fixedIn":null},{"text":"11.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"10.0 | 11.0","eol":{"isEol":true,"eolDate":"2024-06-30T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"10","label":"10 (Buster)","eolFrom":"2024-06-30T00:00:00.000Z","isLts":false,"isMaintained":true,"latestVersion":"10.13"},"product":{"name":"debian","label":"Debian","category":"os"}},"hubHref":"/vendor/debian/debian_linux"},{"vendor":"fedoraproject","product":"fedora","name":"fedora","label":"fedora","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"34","noFixRecorded":false,"fixedIn":null}],"versionsText":"34","eol":{"isEol":true,"eolDate":"2022-06-07T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"34","label":"34","eolFrom":"2022-06-07T00:00:00.000Z","isLts":false,"isMaintained":false,"latestVersion":null},"product":{"name":"fedora","label":"Fedora Linux","category":"os"}},"hubHref":"/vendor/fedoraproject/fedora"},{"vendor":"google","product":"chrome","name":"chrome","label":"chrome","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ unspecified, < 95.0.4638.69","noFixRecorded":false,"fixedIn":null},{"text":"< 95.0.4638.69","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ unspecified, < 95.0.4638.69 | < 95.0.4638.69","eol":{"isEol":null,"eolDate":null,"matchMethod":"cpe","cycle":null,"product":{"name":"chrome","label":"Google Chrome","category":"app"}},"hubHref":"/vendor/google/chrome"}],"affectedCount":5,"eol":{"hasEol":true,"count":2},"references":[{"url":"https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.html","label":"chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.html","hostname":"chromereleases.googleblog.com","tags":["X Refsource MISC","Release Notes"]},{"url":"https://crbug.com/1263462","label":"crbug.com/1263462","hostname":"crbug.com","tags":["X Refsource MISC","Exploit","Issue Tracking"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/","label":"lists.fedoraproject.org/archives/…","hostname":"lists.fedoraproject.org","tags":["Vendor Advisory","X Refsource FEDORA","Release Notes"]},{"url":"https://www.debian.org/security/2022/dsa-5046","label":"www.debian.org/security/2022/dsa-5046","hostname":"www.debian.org","tags":["Vendor Advisory","X Refsource DEBIAN","Mailing List","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38003","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38003","hostname":"www.cisa.gov","tags":["Government Resource","US Government Resource"]},{"url":"https://ubuntu.com/security/CVE-2021-38003","label":"ubuntu.com/security/CVE-2021-38003","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-38003","label":"www.cve.org/CVERecord?id=CVE-2021-38003","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","label":"www.cisa.gov/known-exploited-vulnerabilities-catalog","hostname":"www.cisa.gov","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-38003","label":"security-tracker.debian.org/tracker/CVE-2021-38003","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["DSA-5046-1","MGASA-2022-0050","OPENSUSE-SU-2021:1462-1","OPENSUSE-SU-2022:0047-1","OPENSUSE-SU-2022:0070-1","OPENSUSE-SU-2022:0110-1","OPENSUSE-SU-2024:11604-1","OPENSUSE-SU-2024:11656-1","OPENSUSE-SU-2024:12948-1"],"duplicates":[],"related":["OPENSUSE-SU-2021:1462-1","OPENSUSE-SU-2022:0047-1","OPENSUSE-SU-2022:0070-1","OPENSUSE-SU-2022:0110-1","OPENSUSE-SU-2024:11604-1","OPENSUSE-SU-2024:11656-1","OPENSUSE-SU-2024:12948-1"]},"timeline":[{"kind":"kev-added","date":"2021-11-03T00:00:00.000Z","label":"Added to CISA KEV","detail":"Google Chromium V8 Memory Corruption Vulnerability","source":"cisa"},{"kind":"kev-due","date":"2021-11-17T00:00:00.000Z","label":"CISA remediation due","detail":"Apply updates per vendor instructions.","source":"cisa"},{"kind":"published","date":"2021-11-23T21:30:31.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-10-21T23:25:24.322Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":85,"level":"critical","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-19T22:50:09.045Z","stale":false,"partial":false}}