CVE-2021-38003 — Google Chromium V8 Memory Corruption Vulnerability

provenance: imported · CVE: CVE-2021-38003

CVE-2021-38003: Google Chromium V8 Memory Corruption Vulnerability

CISA Known Exploited Vulnerability (KEV)


Vendor / project	Google
Product	Chromium V8
Date added	2021-11-03
Due date	2021-11-17
Ransomware campaign use	Unknown

Description

Google Chromium V8 Engine has a bug in JSON.stringify, where the internal TheHole value can leak to script code, causing memory corruption. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Required action (CISA)

Apply updates per vendor instructions.

Notes

https://nvd.nist.gov/vuln/detail/CVE-2021-38003

References

NVD: https://nvd.nist.gov/vuln/detail/CVE-2021-38003
KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog