CVE-2018-17463

CVE Database · CVE-2018-17463

CVE-2018-17463

· HIGHAnalyzed

CVSS v3.1

8.8

EPSS

83.90%

Published

Nov 14, 2018

Modified

Oct 24, 2025

CISA Known Exploited Vulnerability

Added: 2022-06-08 · Due: 2022-06-22

Apply updates per vendor instructions.

Public PoC / Exploit (4)

All weaponized →

Exploit-DBGoogle Chrome 67_ 68 and 69 - Object.create Type Confusion (Metasploit)TrickestTrickest PoC index GitHub PoCjhalon/CVE-2018-17463★11 GitHub PoCkdmarti2/CVE-2018-17463★1

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products (5)

google · chrome (up to 70.0.3538.67)vulnerable

redhat · enterprise_linux_desktopvulnerable

redhat · enterprise_linux_servervulnerable

redhat · enterprise_linux_workstationvulnerable

debian · debian_linuxvulnerable

References (15)

http://packetstormsecurity.com/files/156640/Google-Chrome-67-68-69-Object.create-Type-Confusion.html

ExploitThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/105666

Broken LinkThird Party AdvisoryVDB Entry

https://access.redhat.com/errata/RHSA-2018:3004

Third Party Advisory

https://chromereleases.googleblog.com/2018/10/stable-channel-update-for-desktop.html

Release NotesVendor Advisory

https://crbug.com/888923

ExploitIssue Tracking

KEV Catalog EPSS Scores Vendors All CVEs