Google Chromium V8 Heap Buffer Overflow Vulnerability

HIGH 8.8EXPLOITED (CISA KEV)CVE-2021-21148 · Published 09/02/2021 · updated 17/06/2026

Google Chromium V8 Heap Buffer Overflow Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
chrome google	`< 88.0.4324.150`	`88.0.4324.150`

Description

Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

References

packetstormsecurity.com/files/162579/Chrome-Array-Transfer-Bypass.html · Third Party Advisory
chromereleases.googleblog.com/2021/02/stable-channel-update-for-desktop_4.html · Release Notes
crbug.com/1170176 · Permissions Required
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7ACWYJ74Z3YN2XH4QMUEGNBC3VXX464L · Release Notes
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUQSMNV7INLDDSD3RKI5S5EAULX2QC7P · Release Notes
security.gentoo.org/glsa/202104-08 · Third Party Advisory
debian.org/security/2021/dsa-4858 · Mailing List
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2021-21148

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free