CVE-2021-38003: Google Chrome V8 heap corruption via crafted HTML page

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is confirmed exploited in the wild (CISA KEV) with high EPSS and high CVSS impact, though it requires user interaction and is fixed by an available update.

What it is

Google Chrome before 95.0.4638.69 contains an inappropriate implementation in the V8 JavaScript engine that can lead to heap corruption. A remote attacker can trigger it by getting a victim to open a crafted HTML page, and the flaw is listed in CISA KEV, so it has been exploited in the wild.

Impact

Successful exploitation can corrupt heap memory, which typically leads to code execution in the browser process or a crash. The CVSS vector rates confidentiality, integrity and availability impact as high.

Attack surface

Reached over the network through a crafted HTML page rendered in Chrome; no authentication is required, but the victim must interact by visiting or opening the page (UI:R).

Exploitation

CVE-2021-38003 is in CISA KEV with a 2021-11-17 remediation due date, and EPSS shows a 30-day probability of about 0.386 (98.5th percentile). A reference is tagged Exploit, indicating public exploit material exists.

What to do

• Update Chrome to 95.0.4638.69 or later, and apply the corresponding Fedora and Debian security updates.
• Enforce automatic browser updates and verify installed versions across endpoints.
• Restrict or sandbox browser use for high-risk users and block untrusted web content where feasible.
• Track CISA KEV remediation deadlines and confirm patching before the due date.

Detection

• Monitor for Chrome renderer crashes or abnormal process terminations that may indicate heap corruption attempts.
• Hunt proxy and DNS logs for access to known exploit-hosting or malvertising domains tied to Chrome V8 campaigns.
• Alert on Chrome versions below 95.0.4638.69 reporting to management or inventory systems.
• Review endpoint telemetry for suspicious child processes spawned by Chrome.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.