CVE-2018-17463
Google Chrome ≤ 70.0.3538.67
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HSummary
CVE-2018-17463 is a high-severity an unspecified weakness vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 0.3% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The vulnerability is an incorrect side effect annotation in the V8 JavaScript engine within Google Chrome versions prior to 70.0.3538.64. This flaw resides in the handling of object operations that can lead to type confusion during just-in-time compilation and optimization.
A remote attacker can exploit the issue by serving a specially crafted HTML page to a victim. Successful exploitation grants the ability to execute arbitrary code within the renderer sandbox, with the CVSS vector reflecting network attack vector, low complexity, no required privileges, and required user interaction.
Chrome stable channel updates and corresponding Red Hat errata advise immediate upgrade to version 70.0.3538.64 or later to address the defect. Public references include a detailed Chromium bug report and a proof-of-concept exploit targeting Chrome 67 through 69.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2018-9216
Vulnerability Data
Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- CWE(s)
- KEV Date Added
- 08 June 2022
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.