Google Chromium V8 Remote Code Execution Vulnerability

HIGH 8.8EXPLOITED (CISA KEV)CVE-2018-17463 · Published 14/11/2018 · updated 17/06/2026

Google Chromium V8 Remote Code Execution Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 08/06/2022. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
chrome google	`< 70.0.3538.67`	`70.0.3538.67`

Description

Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

References

packetstormsecurity.com/files/156640/Google-Chrome-67-68-69-Object.create-Type-Confusion.html · Exploit
securityfocus.com/bid/105666 · Broken Link
access.redhat.com/errata/RHSA-2018:3004 · Third Party Advisory
chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html · Release Notes
crbug.com/888923 · Exploit
security.gentoo.org/glsa/201811-10 · Third Party Advisory
debian.org/security/2018/dsa-4330 · Mailing List
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2018-17463

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free