Log in Start free

Actively exploited · Published Apr 24, 2017 · Assigned by Chrome

CVE-2017-5030

High 8.8 Exploited

In plain English

A high-severity out-of-bounds read in Google Chrome prior to 57.0.2987.98 for Linux, Windows and Mac, and 57.0.2987.108 for Android. Attackers are actively exploiting it in the wild (listed by CISA on June 8, 2022). The chance it is exploited in the next 30 days is estimated at 40.6% (higher than 99% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)40.6%top 1.3% of all CVEs
Exploited in the wildYesCISA KEV since Jun 8, 2022
Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jun 22, 2022.

Official description

Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page.

Affected products (as reported)

VendorProductVersions
n/a Google Chrome prior to 57.0.2987.98 for Linux, Windows and Mac, and 57.0.2987.108 for Android Google Chrome prior to 57.0.2987.98 for Linux, Windows and Mac, and 57.0.2987.108 for Android

Weakness: CWE-125 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References