CVE-2018-17463: Google Chrome V8 side-effect annotation flaw allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityRemote code execution in a widely deployed browser with confirmed in-the-wild exploitation and very high EPSS, though it requires user interaction and a patch has long been available.

What it is

V8 in Google Chrome before 70.0.3538.64 has an incorrect side effect annotation, producing a type confusion that lets a crafted HTML page run arbitrary code inside the browser sandbox. The flaw is remotely reachable and has been exploited in the wild, so unpatched Chrome and Chromium-based browsers remain a real risk.

Impact

An attacker who gets a victim to load a crafted page can execute arbitrary code in the renderer sandbox, and combined with a sandbox escape could reach the host. At minimum it gives code execution in the browser process context of the affected component.

Attack surface

Reached over the network by a crafted HTML page rendered in Chrome; the CVSS vector shows no privileges required but user interaction (opening the page) is required. No authentication is needed.

Exploitation

Listed in CISA KEV since 2022-06-08 with a 2022-06-22 due date, and EPSS is 0.84564 (99.69th percentile). Multiple references are tagged Exploit, confirming public exploit material exists.

What to do

• Update Chrome to 70.0.3538.64 or later, and apply the corresponding Red Hat, Debian and Gentoo advisories for bundled Chromium.
• Enforce automatic browser updates and verify version compliance across endpoints.
• Restrict or isolate browsing of untrusted sites, and keep the browser sandbox enabled.
• Track CISA KEV remediation deadlines and confirm the 2022-06-22 due date was met.
• Monitor for Chromium/Electron components that embed the vulnerable V8 and patch them separately.

Detection

• Alert on Chrome/Chromium versions below 70.0.3538.64 in asset inventory.
• Hunt for browser processes spawning unexpected child processes or writing executables to temp paths.
• Review proxy and DNS logs for known exploit-hosting domains tied to this CVE.
• Correlate endpoint telemetry for renderer crashes followed by suspicious code execution.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.