EXPOSURES › CVE-2021-38003
CVE-2021-38003
HIGH ⌖ ON CISA KEV · EXPLOITEDA memory corruption bug in Google Chromium V8's JSON.stringify function leaked internal data to script code, causing corruption across multiple Chromium-based browsers.
This memory corruption vulnerability in the Chromium V8 engine allowed internal values to leak into script code, leading to memory corruption in browsers like Chrome, Edge, and Opera. DIB organizations must care because unpatched Chromium-based browsers could be exploited for remote code execution, violating CMMC/NIST 800-171 requirements for patch management and system integrity. Organizations should enforce strict patching cycles for all Chromium-based endpoints and monitor for exploitation attempts.
Shame score — A memory corruption bug in a widely used engine was actively exploited in the wild (KEV), indicating avoidable negligence in patching and vulnerability management.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Google Chromium V8 Engine has a bug in JSON.stringify, where the internal TheHole value can leak to script code, causing memory corruption. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
"Google Chromium V8 Engine has a bug in JSON.stringify..."
| PRODUCT | STATUS |
|---|---|
| Google Services (Google Cloud Platform Products and underlying Infrastructure) Google |
Authorized |
| Google Workspace Google |
Authorized |