CVE-2021-38003

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2021-38003 8.8

Google · Chromium V8 · Added 2021-11-03 · Published 2021-11-23

3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityGoogle Chromium V8 Memory Corruption Vulnerability

VendorGoogle

ProductChromium V8

Date added2021-11-03

Due date2021-11-17

CISA catalogView on CISA KEV catalog

Required actionApply updates per vendor instructions.

CWECWE-755

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Descriptions

KEV: Google Chromium V8 Engine has a bug in JSON.stringify, where the internal TheHole value can leak to script code, causing memory corruption. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

NVD: Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-09-17 23:55 UTC

Wall time48.7s

Searches5

Component defaultyes

Sources https://nvd.nist.gov/vuln/detail/CVE-2021-38003
https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.html
https://crbug.com/1263462
https://starlabs.sg/blog/2022/12-thehole-new-world-how-a-small-leak-will-sink-a-great-browser-cve-2021-38003/
https://github.com/SpiralBL0CK/Chrome-V8-RCE-CVE-2021-38003
https://www.numencyber.com/from-leaking-thehole-to-chrome-renderer-rce-2/
https://www.zerosday.com/post/cves/cve-2021-38003-chromium-v8-lab
https://www.sentinelone.com/vulnerability-database/cve-2021-38003/
https://github.com/star-sg/CVE/tree/master/CVE-2021-38003
https://blog.google/threat-analysis-group/protecting-android-users-from-0-day-attacks/

Hunting hypothesis agent

Hunt TLS-inspecting WAF/proxy page JS for try/catch around JSON.stringify on arrays of multi-megabyte strings whose caught value is fed to Map.set and repeated Map.delete (size -1), plus EDR for renderer WebAssembly RWX writes.

Research details

ComponentV8 JavaScript engine JsonStringifier::SerializeObject() method in JSON.stringify implementation

PreconditionsSuccessful exploitation requires that a user running Google Chrome (or any Chromium-based browser such as Microsoft Edge or Opera) prior to version 95.0.4638.69 visits a specially crafted HTML page controlled by the attacker. The attacker must deliver the malicious page to the victim, typically through phishing links, malvertising, compromised websites, or injected content. No additional privileges, browser extensions, or special configurations are required. Upon page load, the embedded JavaScript creates a deeply nested array structure containing oversized strings that triggers a buffer overflow within V8’s JSON.stringify implementation (specifically the IncrementalStringBuilder::Accumulate function called via Extend() rather than Finish()). Due to a missing exception handler, the internal TheHole sentinel value is leaked as the caught exception instead of a proper Error object. The attacker then uses the leaked TheHole value as a key in Map.prototype.set/delete operations to corrupt the map’s internal element count to -1, enabling out-of-bounds read/write on adjacent heap memory. This provides the primitives needed to overwrite the WASM memory protection flag and achieve arbitrary code execution within the Chrome renderer process. agent

DeliveryLure HTML page whose JS string-overflows JSON.stringify (arrays holding ~8 MB strings, e.g. '"'.repeat(0x800000)) and catches the leaked TheHole sentinel, then uses it as a Map key: map.set(hole,1) plus repeated map.delete(hole) drives map.size to -1, and later map.set calls overwrite an adjacent float array's length for OOB read/write before shellcode is written into a WebAssembly RWX page. Public ITW-chain samples additionally embed a downloader shellcode (docx.wps-c.net).

Public PoCyes

PoC URLs https://github.com/SpiralBL0CK/Chrome-V8-RCE-CVE-2021-38003
https://starlabs.sg/blog/2022/12-thehole-new-world-how-a-small-leak-will-sink-a-great-browser-cve-2021-38003/
https://crbug.com/1263462
https://www.numencyber.com/from-leaking-thehole-to-chrome-renderer-rce-2/
https://github.com/star-sg/CVE/tree/master/CVE-2021-38003 Third-party repos; verify before use.

Advisoryhttps://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.html

Exploit notesExploited in the wild as a zero-day (KEV; Google TAG documented exploitation against Android users). Deterministic trigger - no race required. Public full-chain renderer-RCE exploits exist (StarLabs pwn.js, Numen Cyber, extracted ITW exp.html); full compromise needs a separate sandbox escape, and StarLabs zeroes FLAG_wasm_memory_protection_keys to bypass wasm memory protection before the RWX write.

SummaryCVE-2021-38003 is an inappropriate implementation in V8's JSON.stringify (JsonStringifier::SerializeArrayLikeSlow): a string-length overflow raised via IncrementalStringBuilder::Extend() returns EXCEPTION with no pending exception, leaking V8's internal TheHole sentinel to script. Using TheHole as a Map key drives map.size to -1 and corrupts the OrderedHashMap, giving an out-of-bounds write that public full-chain exploits (StarLabs SG, Numen Cyber) escalate to renderer RCE via a WebAssembly RWX page overwrite. Exploited in the wild as a zero-day and patched in Chrome 95.0.4638.69.

Tia coverage

First reported2026-09-11

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware what-tencent-s-sogou-flaw-reveals-about-state-sponsored-cyberatt

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.