CVE-2021-21148

Google Chromium V8 Heap Buffer Overflow Vulnerability

Published Feb 9, 2021 · updated Jun 16, 2026 · google chrome

Google Chromium V8 Engine contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

Feb 9, 2021 · Catalog
Detected
Google Chromium V8 Engine contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Nov 3, 2021 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Nov 17, 2021 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Google Chromium V8 Engine contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Required action

Apply updates per vendor instructions.

CISA due date Nov 17, 2021

Affected

cpe debian/debian linux10.0
cpe fedoraproject/fedora32
cpe fedoraproject/fedora33
cpe google/chromeversion unspecified
vendor Google Chromium V8version unspecified

Sources

CISA KEVConfirmed exploitationCVE-2021-21148
Google Chromium V8 Engine contains a heap buffer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
cisa.gov
CVE.orgVulnerability recordCVE-2021-21148
Official CVE identifier
cve.org
FIRST EPSSExploitation probabilityCVE-2021-21148
30-day exploitation probability 20.0%
first.org
NIST NVDVulnerability recordCVE-2021-21148
Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
nvd.nist.gov
Packet Storm SecurityCited referencehttp://packetstormsecurity.com/files/162579/Chrome-Array-Transfer-Bypass.html
Packet Storm link already published on the finding.
packetstormsecurity.com