Memory Corruption in Chromium V8 JSON.stringify Affects Chrome, Edge, Opera
CISA: Google Chromium V8 Memory Corruption Vulnerability
CVSS 3.1
8.8high
EPSS
39%p98
Published
()
KEV added
AI analysis
CVE-2021-38003 is a memory corruption flaw in the V8 JavaScript engine used by Chromium, in which the engine's internal 'TheHole' sentinel value can leak into script-visible data during JSON.stringify processing (a heap-corruption condition tracked as CWE-122 and CWE-755). It is triggered when crafted JavaScript causes JSON.stringify to expose this internal value to script code. An attacker who can induce a victim to load malicious web content can leverage the resulting corruption, typically chained with further techniques, to execute code within the browser renderer or crash it. All users of Chromium-based browsers — explicitly including Google Chrome, Microsoft Edge, and Opera, and by extension other Chromium derivatives — are affected. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2021-11-03, carries a 38.6% EPSS probability of exploitation within 30 days (98th percentile), and no public proof-of-concept is known.
What to do: Update all Chromium-based browsers (Chrome, Edge, Opera, and any Chromium-embedded or Electron-style applications in your estate) to the latest vendor-patched releases, per the CISA KEV required action to apply updates per vendor instructions. Verify remediated browser versions via enterprise update management and browser version reporting, prioritizing user workstations and externally reachable systems. Because exploitation is confirmed in the wild, treat unpatched Chromium browsers as an active exposure rather than a theoretical risk.
Affected
Google Chromium V8 (JavaScript engine)
—
Google Chrome (Chromium-based)
—
Microsoft Edge (Chromium-based)
—
Opera browser (Chromium-based)
—
Estimated exposure
mass≈3 billion users (combined Chromium-based browser install base, Chrome alone accounting for the large majority) — Chromium/V8 is the world's dominant browser engine, powering Chrome, Edge, Opera and other derivatives whose combined global user base is in the billions, so effectively every Chromium-based browser install is potentially affected.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
Inappropriate implementation in V8 in Google Chrome prior to 95.0.4638.69 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
China-linked UNC3569 exploited CVE-2026-51990 in Sogou Input Method to deploy the GRAYRABBIT backdoor in active espionage intrusions.
Gen Threat Labs discovered UNC3569 exploiting CVE-2026-51990, a one-click RCE in Tencent's Sogou Input Method for Windows that chains an insecure sgbiz: protocol handler with an unsandboxed Chromium 80 CEF webview. The chain weaponizes CVE-2021-38003 (V8 type confusion) to run shellcode that DLL-sideloads via 7z.exe/7z.dll and deploys the GRAYRABBIT backdoor, which beacons over RC4-encrypted raw TCP 443 to mail.uaiubifas[.]top. Tencent patched the issue in version 16.3.0.3498, released via automatic updates on April 21, 2026. UNC3569 is a PRC-nexus espionage actor targeting government, education, technology, and financial sectors across East and Southeast Asia.
Actively exploited one-click flaw in Sogou Input Method (CVE-2026-51990) let UNC3569 deploy the GRAYRABBIT espionage backdoor on Windows.
Gen Digital researchers found three weaknesses in Sogou Input Method's sgbiz protocol handler that chain into a one-click RCE running with the signed-in user's permissions. UNC3569 used the chain in an active intrusion, leveraging an unsandboxed Chromium 80 embedded browser, the known V8 flaw CVE-2021-38003, and DLL sideloading via 7-Zip to deploy the GRAYRABBIT backdoor. Tencent fixed the issue in version 16.3.0.3498 within 12 days of disclosure; Sogou is used by hundreds of millions of people, mainly in China.
China-linked UNC3569 exploited a Sogou Input Method flaw to deploy GRAYRABBIT backdoor on Windows machines across East and Southeast Asia.
Gen Digital found that China-linked UNC3569, a hacker-for-hire group tracked by Google since 2021, exploited a flaw in Sogou Input Method's Windows sgbiz: link handler to reach a sandbox-disabled Chromium 80 build and exploit 2021's CVE-2021-38003 for code execution. The chain delivered GRAYRABBIT, a remote shell backdoor capable of file transfer and module loading, via a 7-Zip DLL sideloading trick gated on process count. Tencent fixed the handler flaw in April 2026 but the embedded browser remains outdated. Sogou has over 455 million monthly users and roughly 70% share of Chinese input methods.