CVE-2018-17480highunder attackCWE-787

CVE-2018-17480: high-severity vulnerability in Google Chrome

Published · Updated

Follow this CVE+ Monitor Chrome+ Monitor chromium

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.8epss 36%
from disclosure to weapon
Published on NVDDec 11
CISA KEV+1275d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
3 products (12 components)
Red Hat Enterprise Linux Desktop Supplementary (v. 6) · Red Hat Enterprise Linux Server Supplementary (v. 6) · Red Hat Enterprise Linux Workstation Supplementary (v. 6)
fix ↗
Action required by CISAfederal deadline: 2022-06-22

Apply updates per vendor instructions.

In short

A vulnerability in Google Chrome's V8 engine allows attackers to run malicious JavaScript code when processing specially crafted web pages, potentially breaking out of Chrome's security sandbox and executing arbitrary code on your computer.

Technical detail

CWE-787 out-of-bounds write vulnerability in V8 array deserialization allows remote code execution within the sandbox environment. Attack vector is a crafted HTML page delivered to a user; successful exploitation enables arbitrary code execution, requiring user interaction (visiting a malicious page) as the primary precondition. Chrome versions before 71.0.3578.80 are affected.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Google · Chrome
Related CVEs — Google Chrome

In the same product, most dangerous first.

CVE-2023-4863HIGHCVE-2023-4863EPSS 100.0%KEVCVE-2018-17463HIGHCVE-2018-17463EPSS 84.6%KEVCVE-2021-21224HIGHCVE-2021-21224EPSS 84.2%KEVCVE-2020-6418HIGHCVE-2020-6418EPSS 78.8%KEVCVE-2022-2294HIGHCVE-2022-2294EPSS 70.8%KEVCVE-2021-21220HIGHCVE-2021-21220EPSS 70.4%KEV