Vulnerability record · CVE-2018-6065 · published 14 November 2018
CVE-2018-6065: Chrome V8 integer overflow leads to heap corruption
Google · Chrome
Google Chrome before 65.0.3325.146 contains an integer overflow in V8 when computing the allocation size for a new JavaScript object. The miscalculated size can corrupt the heap, and a crafted HTML page can trigger it. It matters because Chrome is widely deployed and the flaw is listed in CISA KEV with a very high EPSS score.
Description
Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityThe flaw is in CISA KEV with a 99th percentile EPSS score and public exploit references, though it requires user interaction and affects an older Chrome branch.
What it is
Google Chrome before 65.0.3325.146 contains an integer overflow in V8 when computing the allocation size for a new JavaScript object. The miscalculated size can corrupt the heap, and a crafted HTML page can trigger it. It matters because Chrome is widely deployed and the flaw is listed in CISA KEV with a very high EPSS score.
Impact
An attacker can corrupt heap memory in the renderer, which can lead to code execution or a crash in the browser process context. The CVSS vector rates confidentiality, integrity and availability impact as high.
Attack surface
Reached remotely over the network by loading a crafted HTML page; the CVSS vector shows no privileges required but user interaction required, so a victim must open the page. No authentication is needed.
Exploitation
CVE-2018-6065 is in CISA KEV (added 2022-06-08) and has an EPSS 30-day probability of 0.603 (99th percentile). References include Exploit-DB and a Chromium issue tagged Exploit, indicating public exploit material exists.
What to do
- Update Chrome to 65.0.3325.146 or later, and apply the corresponding Red Hat and Debian errata for packaged Chromium.
- Track the CISA KEV due date and confirm all managed endpoints and browsers are patched.
- Restrict or sandbox browser use on high-value systems and enforce automatic updates where possible.
- Block or filter untrusted HTML content at the network and email gateway to reduce exposure to crafted pages.
Detection
- Monitor for Chrome renderer crashes or abnormal process terminations that cluster around browsing activity.
- Hunt for known exploit artifacts and suspicious JavaScript delivery from the Exploit-DB and Chromium issue references.
- Alert on outbound connections from browser processes to untrusted hosts following page loads.
- Inventory Chrome and Chromium versions across endpoints and flag anything below 65.0.3325.146.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2018-6065 to the Known Exploited Vulnerabilities catalog on 8 June 2022 as "Google Chromium V8 Integer Overflow Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 22 June 2022.
Affected products
6 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2018-6065 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2018-6065), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
