CVE-2021-38003
Google Chromium V8 Memory Corruption Vulnerability
Description
CVE-2021-38003 is a high-severity improper handling of exceptional conditions vulnerability affecting Google Chromium V8. Google Chromium V8 Engine has a bug in JSON.stringify, where the internal TheHole value can leak to script code, causing memory corruption. This vulnerability could affect multiple web browsers that utilize Chromium, including Google Chrome, Microsoft Edge, and Opera. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 74.34% (98.8th percentile), this vulnerability has a significant probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 95.0.4638.69 | |
| fedoraproject | fedora | 34 |
| debian | debian linux | 10.0; 11.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.html(Release Notes)
- https://crbug.com/1263462(Exploit, Issue Tracking)
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/(Release Notes)
- https://www.debian.org/security/2022/dsa-5046(Mailing List, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38003(US Government Resource)
Weakness Type
CWE-755: Improper Handling of Exceptional Conditions
Improper Handling of Exceptional Conditions is a vulnerability where software does not handle or incorrectly handles an exceptional condition that occurs during operation. This differs from improper checking (CWE-754) in that the condition is detected but the response is inadequate—such as ignoring the error, catching exceptions without taking corrective action, or allowing exceptions to propagate inappropriately.
Learn more: CWE-755 — Improper Handling of Exceptional Conditions
Impact Analysis
CVE-2021-38003 carries a CVSS 3.1 score of 8.8 (HIGH), indicating a high-severity threat. The vulnerability is exploitable over the network with low attack complexity and requires no authentication, though user interaction is needed. Successful exploitation can severely compromise data confidentiality, and allow unauthorized modification of data and systems, and cause complete service disruption. Organizations running affected Chromium-based browsers face significant operational risk if this vulnerability remains unpatched.
Exploit Maturity
CVE-2021-38003 is confirmed as actively exploited through its listing in the CISA Known Exploited Vulnerabilities catalog. The EPSS score of 74.34% (98.8th percentile) indicates a significant probability of exploitation. The vulnerability affects a widely deployed browser engine, increasing the pool of potential targets. Federal agencies were required to remediate this vulnerability by 2021-11-17 per CISA's binding operational directive.
Remediation
- Apply vendor patches immediately as mandated by CISA KEV: Apply updates per vendor instructions.
- Update all Chromium-based browsers (Google Chrome, Microsoft Edge, Opera, and others) to the latest stable version that addresses this vulnerability.
- If immediate patching is not possible, restrict access to untrusted web content and consider disabling the affected browser component where feasible.
- Monitor systems for indicators of compromise, including unusual process activity, unexpected network connections, and unauthorized configuration changes.
- Review security logs and conduct threat hunting to determine if the vulnerability was exploited prior to patching.
Technical Details
CVE-2021-38003 affects Google Chromium V8. Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. The attack vector is network-based, meaning an attacker can exploit this vulnerability remotely by luring a victim to visit a specially crafted webpage. The CVSS score of 8.8 reflects the combination of low attack complexity, no required privileges, and high impact across confidentiality, integrity, availability.
Frequently Asked Questions
Is CVE-2021-38003 being actively exploited?
Yes. CVE-2021-38003 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 74.34% (98.8th percentile) further indicates a significant exploitation probability.
What products are affected by CVE-2021-38003?
CVE-2021-38003 affects Google Chromium V8. Since the vulnerability resides in the Chromium engine, multiple browsers that utilize Chromium may be affected, including Google Chrome, Microsoft Edge, and Opera.
How do I fix CVE-2021-38003?
Apply updates per vendor instructions. Ensure all Chromium-based browsers are updated to the latest patched versions. If patching is not immediately possible, implement network-level mitigations to limit exposure to untrusted web content.
How severe is CVE-2021-38003?
CVE-2021-38003 has a CVSS 3.1 score of 8.8 (HIGH). This is a high-severity vulnerability that requires immediate attention and remediation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.