Actively exploited · Published Nov 14, 2018 · Assigned by Chrome
CVE-2018-17463
High 8.8 Exploited
In plain English
A high-severity security flaw in Chrome from Google. Attackers are actively exploiting it in the wild (listed by CISA on June 8, 2022). The chance it is exploited in the next 30 days is estimated at 84.6% (higher than 99.7% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Apply updates per vendor instructions.
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)84.6%top 0.3% of all CVEs
Exploited in the wildYesCISA KEV since Jun 8, 2022
Attack tooling2Metasploit, Public PoC
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jun 22, 2022.
Official description
Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Affected products (as reported)
References
- DSA-4330 vendor-advisory, x_refsource_DEBIAN
- https://crbug.com/888923 x_refsource_MISC
- RHSA-2018:3004 vendor-advisory, x_refsource_REDHAT
- GLSA-201811-10 vendor-advisory, x_refsource_GENTOO
- https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html x_refsource_CONFIRM
- 105666 vdb-entry, x_refsource_BID
- http://packetstormsecurity.com/files/156640/Google-Chrome-67-68-69-Object.create-Type-Confusion.html x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-17463 government-resource