{"schema":"vulnpedia.research/1","cve":"CVE-2021-38003","references":[{"url":"https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.html","tags":["x_refsource_MISC","x_transferred","Release Notes"],"source":"mitre","sourceId":"Chrome","modified":"2022-01-15T14:08:16.000Z","origins":[{"source":"mitre","sourceId":"Chrome","modified":"2022-01-15T14:08:16.000Z","url":"https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.html"},{"source":"mitre","sourceId":"CVE","modified":"2024-08-04T01:30:09.213Z","url":"https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.html"},{"source":"nvd","sourceId":"CVE-2021-38003","modified":"2026-06-17T04:01:23.563","url":"https://chromereleases.googleblog.com/2021/10/stable-channel-update-for-desktop_28.html"}]},{"url":"https://crbug.com/1263462","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking"],"source":"mitre","sourceId":"Chrome","modified":"2022-01-15T14:08:16.000Z","origins":[{"source":"mitre","sourceId":"Chrome","modified":"2022-01-15T14:08:16.000Z","url":"https://crbug.com/1263462"},{"source":"mitre","sourceId":"CVE","modified":"2024-08-04T01:30:09.213Z","url":"https://crbug.com/1263462"},{"source":"nvd","sourceId":"CVE-2021-38003","modified":"2026-06-17T04:01:23.563","url":"https://crbug.com/1263462"}]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Release Notes"],"source":"mitre","sourceId":"Chrome","modified":"2022-01-15T14:08:16.000Z","origins":[{"source":"mitre","sourceId":"Chrome","modified":"2022-01-15T14:08:16.000Z","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/"},{"source":"mitre","sourceId":"CVE","modified":"2024-08-04T01:30:09.213Z","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/"},{"source":"nvd","sourceId":"CVE-2021-38003","modified":"2026-06-17T04:01:23.563","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3W46HRT2UVHWSLZB6JZHQF6JNQWKV744/"}]},{"url":"https://www.debian.org/security/2022/dsa-5046","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Mailing List","Third Party Advisory"],"source":"mitre","sourceId":"Chrome","modified":"2022-01-15T14:08:16.000Z","origins":[{"source":"mitre","sourceId":"Chrome","modified":"2022-01-15T14:08:16.000Z","url":"https://www.debian.org/security/2022/dsa-5046"},{"source":"mitre","sourceId":"CVE","modified":"2024-08-04T01:30:09.213Z","url":"https://www.debian.org/security/2022/dsa-5046"},{"source":"nvd","sourceId":"CVE-2021-38003","modified":"2026-06-17T04:01:23.563","url":"https://www.debian.org/security/2022/dsa-5046"}]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38003","tags":["government-resource","US Government Resource"],"source":"mitre","sourceId":"CISA-ADP","modified":"2025-10-21T23:25:24.322Z","origins":[{"source":"mitre","sourceId":"CISA-ADP","modified":"2025-10-21T23:25:24.322Z","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38003"},{"source":"nvd","sourceId":"CVE-2021-38003","modified":"2026-06-17T04:01:23.563","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-38003"}]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-38003.json","tags":["vendor-advisory"],"source":"redhat","sourceId":"CVE-2021-38003","modified":"2025-11-21T13:55:22+00:00","origins":[{"source":"redhat","sourceId":"CVE-2021-38003","modified":"2025-11-21T13:55:22+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-38003.json"}]},{"url":"https://access.redhat.com/security/cve/CVE-2021-38003","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2021-38003","modified":"2025-11-21T13:55:22+00:00","origins":[{"source":"redhat","sourceId":"CVE-2021-38003","modified":"2025-11-21T13:55:22+00:00","url":"https://access.redhat.com/security/cve/CVE-2021-38003"}]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-38003","tags":["vendor-reference"],"source":"redhat","sourceId":"CVE-2021-38003","modified":"2025-11-21T13:55:22+00:00","origins":[{"source":"redhat","sourceId":"CVE-2021-38003","modified":"2025-11-21T13:55:22+00:00","url":"https://www.cve.org/CVERecord?id=CVE-2021-38003"}]},{"source":"euvd","sourceId":"EUVD-2021-24476","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-24476","tags":["ADVISORY"],"origins":[{"source":"euvd","sourceId":"EUVD-2021-24476","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-24476"}]},{"url":"https://vulncheck.com/kev","tags":["ADVISORY"],"source":"vulncheck-kev","sourceId":"CVE-2021-38003","modified":"2021-10-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","modified":"2021-10-26T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2021-38003","modified":"2021-10-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","modified":"2021-10-26T00:00:00Z","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit"}]},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2021-38003","modified":"2021-10-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","modified":"2021-10-26T00:00:00Z","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"url":"https://decoded.avast.io/janvojtesek/dota-2-under-attack-how-a-v8-bug-was-exploited-in-the-game/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2021-38003","modified":"2021-10-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","modified":"2021-10-26T00:00:00Z","url":"https://decoded.avast.io/janvojtesek/dota-2-under-attack-how-a-v8-bug-was-exploited-in-the-game/"}]},{"url":"https://blog.talosintelligence.com/mercenary-intellexa-predator/","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2021-38003","modified":"2021-10-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","modified":"2021-10-26T00:00:00Z","url":"https://blog.talosintelligence.com/mercenary-intellexa-predator/"}]},{"url":"https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/Buying_Spying_-_Insights_into_Commercial_Surveillance_Vendors.pdf","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2021-38003","modified":"2021-10-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","modified":"2021-10-26T00:00:00Z","url":"https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/Buying_Spying_-_Insights_into_Commercial_Surveillance_Vendors.pdf"}]},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/intellexa-zero-day-exploits-continue","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2021-38003","modified":"2021-10-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","modified":"2021-10-26T00:00:00Z","url":"https://cloud.google.com/blog/topics/threat-intelligence/intellexa-zero-day-exploits-continue"}]},{"url":"https://www.gendigital.com/blog/insights/research/one-click-backdoor-sogou","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2021-38003","modified":"2021-10-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","modified":"2021-10-26T00:00:00Z","url":"https://www.gendigital.com/blog/insights/research/one-click-backdoor-sogou"}]},{"url":"https://www.recordedfuture.com/blog/september-2026-cve-landscape","tags":["KEV report"],"source":"vulncheck-kev","sourceId":"CVE-2021-38003","modified":"2021-10-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","modified":"2021-10-26T00:00:00Z","url":"https://www.recordedfuture.com/blog/september-2026-cve-landscape"}]},{"url":"https://vulncheck.com/xdb/1a0b1ef4a809","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"1a0b1ef4a809","modified":"2021-10-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"1a0b1ef4a809","modified":"2021-10-26T00:00:00Z","url":"https://vulncheck.com/xdb/1a0b1ef4a809"}]},{"url":"https://github.com/SpiralBL0CK/Chrome-V8-RCE-CVE-2021-38003","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"1a0b1ef4a809","modified":"2021-10-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"1a0b1ef4a809","modified":"2021-10-26T00:00:00Z","url":"https://github.com/SpiralBL0CK/Chrome-V8-RCE-CVE-2021-38003"}]},{"url":"https://vulncheck.com/xdb/72c3951ee77e","tags":["XDB catalogue"],"source":"vulncheck-kev","sourceId":"72c3951ee77e","modified":"2021-10-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"72c3951ee77e","modified":"2021-10-26T00:00:00Z","url":"https://vulncheck.com/xdb/72c3951ee77e"}]},{"url":"https://github.com/caffeinedoom/CVE-2021-38003","tags":["XDB repository"],"source":"vulncheck-kev","sourceId":"72c3951ee77e","modified":"2021-10-26T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"72c3951ee77e","modified":"2021-10-26T00:00:00Z","url":"https://github.com/caffeinedoom/CVE-2021-38003"}]}],"packages":[],"pocCandidates":[{"url":"https://github.com/SpiralBL0CK/Chrome-V8-RCE-CVE-2021-38003","source":"poc-in-github","sourceId":"CVE-2021-38003","description":"CVE-2021-38003 exploits extracted from https://twitter.com/WhichbufferArda/status/1609604183535284224","modified":"2026-09-22T09:01:52Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2021-38003","url":"https://github.com/SpiralBL0CK/Chrome-V8-RCE-CVE-2021-38003"},{"source":"poc-in-github","sourceId":"CVE-2021-38003","modified":"2026-09-22T09:01:52Z","url":"https://github.com/SpiralBL0CK/Chrome-V8-RCE-CVE-2021-38003"}],"tags":[]},{"url":"https://github.com/jamezx32/CVE-2021-38003","source":"poc-in-github","sourceId":"CVE-2021-38003","description":"V8 TheHole leak via JSON.stringify - PoC + OrderedHashMap amplification","modified":"2026-10-14T11:02:10Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2021-38003","url":"https://github.com/jamezx32/CVE-2021-38003"},{"source":"poc-in-github","sourceId":"CVE-2021-38003","modified":"2026-10-14T11:02:10Z","url":"https://github.com/jamezx32/CVE-2021-38003"}],"tags":[]}],"cataloguedPoc":[{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"1a0b1ef4a809","url":"https://vulncheck.com/xdb/1a0b1ef4a809","cve":"CVE-2021-38003","dateAdded":"2023-12-21T00:17:37Z","modified":"2021-10-26T00:00:00Z","exploitType":"client-side","repositoryUrl":"https://github.com/SpiralBL0CK/Chrome-V8-RCE-CVE-2021-38003","observations":[{"dateAdded":"2023-12-21T00:17:37Z","exploitType":"client-side"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"1a0b1ef4a809","modified":"2021-10-26T00:00:00Z","url":"https://vulncheck.com/xdb/1a0b1ef4a809"}]},{"source":"vulncheck-kev","kind":"vulncheck-xdb","verification":"catalogued","sourceId":"72c3951ee77e","url":"https://vulncheck.com/xdb/72c3951ee77e","cve":"CVE-2021-38003","dateAdded":"2025-05-20T10:49:09Z","modified":"2021-10-26T00:00:00Z","exploitType":"client-side","repositoryUrl":"https://github.com/caffeinedoom/CVE-2021-38003","observations":[{"dateAdded":"2025-05-20T10:49:09Z","exploitType":"client-side"}],"tags":[],"origins":[{"source":"vulncheck-kev","sourceId":"72c3951ee77e","modified":"2021-10-26T00:00:00Z","url":"https://vulncheck.com/xdb/72c3951ee77e"}]}],"vendorStatements":[{"source":"redhat","sourceId":"CVE-2021-38003","modified":"2025-11-21T13:55:22+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-38003.json","productId":"red_hat_products","product":"All currently supported Red Hat products","status":"known_not_affected","remediations":[],"justification":"vulnerable_code_not_present","origins":[{"source":"redhat","sourceId":"CVE-2021-38003","modified":"2025-11-21T13:55:22+00:00","url":"https://security.access.redhat.com/data/csaf/v2/vex/2021/cve-2021-38003.json"}]}],"vendorCoverage":{"total":1,"shown":1,"omitted":0,"source":"redhat"},"exploitationSources":[{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","catalog":"VulnCheck KEV","kind":"catalogue","url":"https://vulncheck.com/kev","dateAdded":"2021-10-26T00:00:00Z","modified":"2021-10-26T00:00:00Z","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown","reportedByVulncheckCanaries":false,"vendorProject":"Google","product":"Chromium V8","dueDate":"2021-11-17T00:00:00Z","cisaDateAdded":"2021-11-03T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","modified":"2021-10-26T00:00:00Z","url":"https://vulncheck.com/kev"}]},{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","catalog":"VulnCheck KEV","kind":"report","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit","dateAdded":"2021-10-26T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","url":"https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit"}]},{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","catalog":"VulnCheck KEV","kind":"report","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","dateAdded":"2021-11-03T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json"}]},{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","catalog":"VulnCheck KEV","kind":"report","url":"https://decoded.avast.io/janvojtesek/dota-2-under-attack-how-a-v8-bug-was-exploited-in-the-game/","dateAdded":"2023-02-10T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","url":"https://decoded.avast.io/janvojtesek/dota-2-under-attack-how-a-v8-bug-was-exploited-in-the-game/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","catalog":"VulnCheck KEV","kind":"report","url":"https://blog.talosintelligence.com/mercenary-intellexa-predator/","dateAdded":"2023-05-25T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","url":"https://blog.talosintelligence.com/mercenary-intellexa-predator/"}]},{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","catalog":"VulnCheck KEV","kind":"report","url":"https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/Buying_Spying_-_Insights_into_Commercial_Surveillance_Vendors.pdf","dateAdded":"2024-02-06T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","url":"https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/Buying_Spying_-_Insights_into_Commercial_Surveillance_Vendors.pdf"}]},{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","catalog":"VulnCheck KEV","kind":"report","url":"https://cloud.google.com/blog/topics/threat-intelligence/intellexa-zero-day-exploits-continue","dateAdded":"2025-12-03T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","url":"https://cloud.google.com/blog/topics/threat-intelligence/intellexa-zero-day-exploits-continue"}]},{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","catalog":"VulnCheck KEV","kind":"report","url":"https://www.gendigital.com/blog/insights/research/one-click-backdoor-sogou","dateAdded":"2026-09-10T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","url":"https://www.gendigital.com/blog/insights/research/one-click-backdoor-sogou"}]},{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","catalog":"VulnCheck KEV","kind":"report","url":"https://www.recordedfuture.com/blog/september-2026-cve-landscape","dateAdded":"2026-10-13T00:00:00Z","firstPartyCanary":false,"origins":[{"source":"vulncheck-kev","sourceId":"CVE-2021-38003","url":"https://www.recordedfuture.com/blog/september-2026-cve-landscape"}]}]}