CVE-2021-38003
Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Actively exploited
- In the CISA exploited-vulnerabilities catalogue since Nov 3, 2021
- US federal agencies must remediate it by Nov 17, 2021 (BOD 22-01)
- Attacked 29 days before the vulnerability was made public
Apply updates per vendor instructions.
Source: CISA KEV · Dec 3, 2025 Feb 6, 2024 May 25, 2023 Feb 10, 2023 Nov 3, 2021 Oct 26, 2021
CVSS score8.8 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HWeakness type (CWE)CWE-755, CWE-755
Vendorsdebian, fedoraproject, google
Affected products
| Vendors | Product | Versions |
|---|---|---|
| chrome | < 95.0.4638.69 | |
| fedoraproject | fedora | 34 |
| debian | debian linux | 10.0 |
Related articles
This product uses the NVD API but is not endorsed or certified by the NVD.