Log in Start free

Actively exploited · Published Oct 27, 2017 · Assigned by Chrome

CVE-2017-5070

High 8.8 Exploited

In plain English

A high-severity type confusion in Google Chrome prior to 59.0.3071.86 for Linux, Windows and Mac, and 59.0.3071.92 for Android. Attackers are actively exploiting it in the wild (listed by CISA on June 8, 2022). The chance it is exploited in the next 30 days is estimated at 32.1% (higher than 98% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)8.8High
Exploit odds (30 days)32.1%top 1.7% of all CVEs
Exploited in the wildYesCISA KEV since Jun 8, 2022
Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jun 22, 2022.

Official description

Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Affected products (as reported)

VendorProductVersions
n/a Google Chrome prior to 59.0.3071.86 for Linux, Windows and Mac, and 59.0.3071.92 for Android Google Chrome prior to 59.0.3071.86 for Linux, Windows and Mac, and 59.0.3071.92 for Android

Weakness: CWE-843 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

References