← Vulnerability feed

Vulnerability record · CVE-2018-17480 · published 11 December 2018

CVE-2018-17480: Google Chrome V8 array deserialization out-of-bounds write

Google · Chrome

Google Chrome before 71.0.3578.80 contains an out-of-bounds write in the V8 JavaScript engine triggered when user-supplied JavaScript runs during array deserialization. A crafted HTML page can corrupt memory and lead to code execution inside the browser sandbox. The flaw is remotely reachable and has been exploited in the wild per CISA KEV.

8.8 CVSS 3.1 High CISA KEV since 8 Jun 2022 EPSS 36% · top 1.6% CWE-787 · Out-of-bounds write
8.8CVSS 3.1 base score, v2 6.8
36%EPSS exploitation probability, 30 days
YesIn CISA KEV, fix deadline passed
5Affected product versions listed by NVD
13References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS 8.8, active exploitation per CISA KEV, and high EPSS percentile make this a high-priority patch despite the age of the CVE.

What it is

Google Chrome before 71.0.3578.80 contains an out-of-bounds write in the V8 JavaScript engine triggered when user-supplied JavaScript runs during array deserialization. A crafted HTML page can corrupt memory and lead to code execution inside the browser sandbox. The flaw is remotely reachable and has been exploited in the wild per CISA KEV.

Impact

An attacker can execute arbitrary code inside the Chrome sandbox, potentially leading to full compromise of the browser process and, depending on sandbox escape, the host.

Attack surface

Reached over the network by a victim loading a crafted HTML page; no authentication is required but user interaction (visiting the page) is needed per the CVSS vector AV:N/UI:R.

Exploitation

Listed in CISA KEV since 2022-06-08 with a required remediation due date of 2022-06-22, and EPSS 30-day probability of 0.3564 (98th percentile), indicating active exploitation. A Chromium issue reference is tagged Exploit.

What to do

  • Update Google Chrome to 71.0.3578.80 or later, and apply the corresponding Red Hat, Debian and Gentoo advisories for bundled Chromium.
  • Enforce automatic browser updates and verify version compliance across endpoints.
  • Restrict or block untrusted web content and drive-by download vectors where feasible.
  • Monitor CISA KEV guidance and re-check for any vendor follow-up patches.

Detection

  • Hunt for Chrome versions below 71.0.3578.80 in asset inventories and endpoint telemetry.
  • Monitor browser crash reports and V8 out-of-bounds write indicators in Chrome crash dumps.
  • Alert on suspicious child processes spawned by Chrome or unusual memory corruption patterns.
  • Review proxy and DNS logs for known exploit delivery domains tied to this CVE.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.

Exploitation in the wild

CISA added CVE-2018-17480 to the Known Exploited Vulnerabilities catalog on 8 June 2022 as "Google Chromium V8 Out-of-Bounds Write Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 22 June 2022.

Affected products

5 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/106084 Broken LinkThird Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2018:3803 Third Party Advisory
https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html Vendor Advisory
https://crbug.com/905940 ExploitIssue Tracking
https://security.gentoo.org/glsa/201908-18 Third Party Advisory
https://www.debian.org/security/2018/dsa-4352 Mailing ListThird Party Advisory
http://www.securityfocus.com/bid/106084 Broken LinkThird Party AdvisoryVDB Entry
https://access.redhat.com/errata/RHSA-2018:3803 Third Party Advisory
https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html Vendor Advisory
https://crbug.com/905940 ExploitIssue Tracking
https://security.gentoo.org/glsa/201908-18 Third Party Advisory
https://www.debian.org/security/2018/dsa-4352 Mailing ListThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-17480 US Government Resource

Track CVE-2018-17480 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2025-32433Erlang/OTP SSH server missing authentication allows remote code executionErlang/OTP SSH servers before OTP-27.3.3, OTP-26.2.5.11 and OTP-25.3.2.20 mishandle SSH protocol messages, letting an unauthenticated attacker execut…KEVEPSS 99%analysed10.0CVE-2025-24201Apple WebKit out-of-bounds write allows sandbox escapeCVE-2025-24201 is an out-of-bounds write in Apple's WebKit that was addressed with improved checks. Maliciously crafted web content may break out of …KEVEPSS 3.8%analysed10.0CVE-2021-44228Apache Log4j2 JNDI lookup remote code executionApache Log4j2 versions 2.0-beta9 through 2.15.0 (excluding 2.12.2, 2.12.3, and 2.3.1) do not protect against attacker-controlled LDAP and other JNDI …KEVEPSS 100%analysed9.8CVE-2026-24061GNU Inetutils telnetd argument injection allows remote auth bypasstelnetd in GNU Inetutils through 2.7 fails to sanitize the USER environment variable, so a value such as "-f root" is passed as an argument to login …KEVEPSS 99%analysed9.8CVE-2025-10585Google Chrome V8 type confusion enables heap corruptionChrome's V8 JavaScript engine contains a type confusion flaw (CWE-843) that can lead to heap corruption when processing a crafted HTML page. It affec…KEVEPSS 5.4%analysed9.8CVE-2025-39682Linux kernel TLS zero-length record handling flaw on rx_listThe Linux kernel TLS receive path mishandles zero-length records that arrive from the rx_list, breaking the assumption that a record type change cann…KEVEPSS 2.9%analysed9.8CVE-2025-24813Apache Tomcat Default Servlet path equivalence enables RCE and file disclosureApache Tomcat mishandles path equivalence for names containing an internal dot, letting a remote unauthenticated attacker write files through the Def…KEVEPSS 100%analysed9.8CVE-2024-9680Mozilla Firefox and Thunderbird use-after-free in Animation timelinesA use-after-free flaw in Animation timelines allows an attacker to execute code in the content process of Firefox and Thunderbird. Mozilla reports ex…KEVEPSS 23%analysed

Source: NIST National Vulnerability Database (record CVE-2018-17480), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.