Vulnerability record · CVE-2021-21148 · published 9 February 2021
CVE-2021-21148: Google Chrome V8 heap buffer overflow via crafted HTML page
Google · Chrome
CVE-2021-21148 is a heap buffer overflow (out-of-bounds write, CWE-787) in the V8 JavaScript engine in Google Chrome prior to 88.0.4324.150. A remote attacker can trigger heap corruption by getting a victim to load a crafted HTML page, which can lead to code execution in the browser process context. It matters because Chrome is widely deployed and the flaw was exploited in the wild before patching.
Description
Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityThe flaw is a remotely reachable heap overflow in a ubiquitous browser, carries a CVSS of 8.8, and is confirmed exploited in CISA KEV, though it requires user interaction and no ransomware use is documented.
What it is
CVE-2021-21148 is a heap buffer overflow (out-of-bounds write, CWE-787) in the V8 JavaScript engine in Google Chrome prior to 88.0.4324.150. A remote attacker can trigger heap corruption by getting a victim to load a crafted HTML page, which can lead to code execution in the browser process context. It matters because Chrome is widely deployed and the flaw was exploited in the wild before patching.
Impact
An attacker who successfully triggers the overflow can corrupt heap memory and potentially achieve arbitrary code execution within the browser's sandboxed renderer, with high confidentiality, integrity and availability impact per the CVSS vector. Full system compromise depends on escaping the sandbox, which this record does not describe.
Attack surface
Reached over the network by serving a crafted HTML page that exercises V8; the CVSS vector shows no privileges required but user interaction required, meaning the victim must visit or open the malicious page. No authentication is needed.
Exploitation
CVE-2021-21148 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), confirming real-world exploitation, and EPSS gives a 30-day probability of about 0.20 (97th percentile). CISA notes no known ransomware campaign use.
What to do
- Update Google Chrome to 88.0.4324.150 or later, and apply the corresponding Fedora, Debian and Gentoo package updates referenced in the advisories.
- Enforce automatic browser updates and verify version compliance across managed endpoints.
- Restrict or isolate browsing of untrusted web content, for example via network controls or remote browsing, until patching is complete.
- Track CISA KEV remediation due dates and confirm closure for any internet-facing or user-browsing systems.
Detection
- Monitor for Chrome renderer crashes or abnormal process terminations that could indicate heap corruption attempts.
- Hunt proxy and DNS logs for access to known exploit-hosting or malformed-page delivery infrastructure around the KEV timeframe.
- Alert on Chrome versions below 88.0.4324.150 reported by endpoint inventory or user-agent telemetry.
- Review endpoint telemetry for suspicious child processes or memory manipulation originating from browser renderer processes.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2021-21148 to the Known Exploited Vulnerabilities catalog on 3 November 2021 as "Google Chromium V8 Heap Buffer Overflow Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 17 November 2021.
Affected products
3 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2021-21148 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-21148), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
