Actively exploited in the wild
Google Chromium V8 Memory Corruption Vulnerability
Google - Chromium V8 · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2021-38003
HighCVSS 8.8KEVSummary
Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Risk Assessment
The risk is that an attacker can remotely execute malicious code in the victim's browser, potentially leading to session hijacking, data theft, or installation of malware.
Recommendation
It is recommended to immediately update Google Chrome to the latest version that includes the fix. Also be cautious when opening unknown web pages.
Other vulnerabilities in Google Chrome
See all- CVE-2026-93387Unknown
Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. The vulnerability was rated High severity by Chromium.
- CVE-2026-93386Unknown
UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. The vulnerability was rated Low severity by Chromium.
- CVE-2026-93385Unknown
Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain sensitive information via a crafted HTML page. The vulnerability was rated Medium severity by Chromium.
- CVE-2026-93384Unknown
Server-side request forgery in Omnibox in Google Chrome on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. The vulnerability was rated Medium severity by Chromium.
- CVE-2026-93383Unknown
Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability was rated Medium severity by Chromium.
- CVE-2026-93382Unknown
Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability was rated High severity by Chromium.
- CVE-2026-93381Unknown
Buffer overflow in PDFium in Google Chrome on Windows prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted PDF file. The vulnerability was rated High severity by Chromium.
- CVE-2026-93380Unknown
Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. The vulnerability was rated Medium severity by Chromium.
- CVE-2026-93379Unknown
Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. The vulnerability was rated High severity by Chromium.
- CVE-2026-93378Unknown
Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. The vulnerability was rated Medium severity by Chromium.
Original NVD description (English source)
Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.