CVE-2021-38003

Timeline

Detection, updates, and resolution for this record.

1. Nov 3, 2021 · Catalog

   Detected

   Google Chromium V8 Engine has a bug in JSON.stringify, where the internal TheHole value can leak to script code, causing memory corruption. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

2. Nov 3, 2021 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. Nov 17, 2021 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   Google Chromium V8 Engine has a bug in JSON.stringify, where the internal TheHole value can leak to script code, causing memory corruption. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Affected

• cpe debian/debian linux10.0
• cpe debian/debian linux11.0
• cpe fedoraproject/fedora34
• cpe google/chromeversion unspecified
• vendor Google Chromium V8version unspecified

Sources

• CISA KEVCVE-2021-38003

  Google Chromium V8 Engine has a bug in JSON.stringify, where the internal TheHole value can leak to script code, causing memory corruption. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

  cisa.gov
• CVE.orgCVE-2021-38003

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2021-38003

  30-day exploitation probability 38.6%

  first.org
• NIST NVDCVE-2021-38003

  Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

  nvd.nist.gov

References

• Release Notes · chromereleases.googleblog.com
• Exploit · crbug.com
• Release Notes · lists.fedoraproject.org
• CISA note · nvd.nist.gov
• Mailing List · debian.org