CVE-2017-5070
Google Chromium V8 Type Confusion Vulnerability
Description
CVE-2017-5070 is a type confusion vulnerability in the Google Chromium V8 JavaScript engine that allows a remote attacker to execute code inside the browser sandbox via a crafted HTML page. The flaw occurs when V8's JIT compiler incorrectly handles type information during optimization, leading to type-confused memory accesses that can be exploited for arbitrary code execution. This vulnerability affects multiple Chromium-based web browsers including Google Chrome, Microsoft Edge, and Opera. CISA has added CVE-2017-5070 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 71.1% (98th percentile), this Chromium V8 type confusion vulnerability is a high-priority security threat.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 59.0.3071.86; < 59.0.3071.92 | |
| redhat | enterprise linux desktop | 6.0 |
| redhat | enterprise linux server | 6.0 |
| redhat | enterprise linux workstation | 6.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/98861(Broken Link, Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id/1038622(Broken Link, Third Party Advisory, VDB Entry)
- https://access.redhat.com/errata/RHSA-2017:1399(Third Party Advisory)
- https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html(Release Notes, Vendor Advisory)
- https://crbug.com/722756(Exploit, Issue Tracking)
- https://security.gentoo.org/glsa/201706-20(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-5070(US Government Resource)
Weakness Type
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
CVE-2017-5070 exploits a type confusion vulnerability in the Chromium V8 engine, where an object is allocated with one type but subsequently accessed using an incompatible type. In V8's JIT compiler, incorrect type assumptions during code optimization lead to the generation of machine code that accesses objects at wrong memory offsets, enabling out-of-bounds memory access and ultimately arbitrary code execution within the browser process.
Learn more: CWE-843 — Access of Resource Using Incompatible Type ('Type Confusion')
Impact Analysis
CVE-2017-5070 enables remote code execution within the Chromium browser sandbox by exploiting a type confusion in V8's JIT compiler, requiring only that a user visits a malicious web page. No authentication or special privileges are needed, and the attack complexity is low. Confidentiality and integrity are critically impacted as the type confusion provides a path to arbitrary read/write memory primitives, allowing an attacker to access browser-stored sensitive data, steal session cookies and credentials, or inject malicious content. The EPSS score of 71.1% (98th percentile) indicates very high exploitation probability. Given that type confusion vulnerabilities in V8 are a well-understood exploitation class, and the broad attack surface across all Chromium-based browsers affects the majority of web users, this vulnerability presents a substantial risk to organizations that have not ensured browser patching.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2017-5070 by including it in the Known Exploited Vulnerabilities catalog, with a remediation deadline of June 22, 2022. The EPSS score of 71.1% (98th percentile) reflects very high exploitation probability. No specific ransomware campaigns have been publicly attributed to this vulnerability. However, V8 type confusion vulnerabilities are premium exploit primitives used by advanced threat actors in targeted browser exploitation campaigns, watering hole attacks, and exploit kits. The availability of public research on V8 type confusion exploitation techniques makes this vulnerability class well-understood and reliably exploitable.
Remediation
- Update all Chromium-based browsers immediately to versions that patch CVE-2017-5070, including Google Chrome, Microsoft Edge, and Opera.
- Enable automatic browser updates on all managed devices to ensure V8 security patches are applied promptly.
- Deploy browser isolation technology to render untrusted web content in isolated environments, neutralizing V8 exploitation attempts.
- Implement web filtering and URL categorization to restrict access to known exploit delivery domains and high-risk web categories.
- Monitor endpoint detection systems for browser exploitation indicators including abnormal V8 JIT behavior, renderer process crashes, or unexpected child process creation from browser processes.
Technical Details
CVE-2017-5070 is a type confusion vulnerability in the V8 JavaScript engine's JIT compiler (Crankshaft/TurboFan) used by Chromium-based browsers. The vulnerability occurs when the JIT compiler's optimization passes incorrectly infer or propagate type information for JavaScript objects, generating optimized machine code that accesses an object using assumptions about its type that do not hold at runtime. When the type-confused access occurs, memory is read or written at incorrect offsets calculated for the assumed type rather than the actual type, leading to out-of-bounds memory access. An attacker crafts JavaScript that triggers the specific optimization path containing the type confusion, then uses the resulting memory corruption to build read/write primitives. These primitives are escalated to code execution by overwriting function pointers, vtable entries, or JIT code pages within the V8 heap.
Frequently Asked Questions
Is CVE-2017-5070 being actively exploited?
Yes. CISA has confirmed active exploitation by adding it to the KEV catalog. The EPSS score of 71.1% (98th percentile) indicates very high exploitation probability. V8 type confusion vulnerabilities are well-understood and reliably exploitable by advanced threat actors.
What products are affected by CVE-2017-5070?
CVE-2017-5070 affects all Chromium-based browsers including Google Chrome, Microsoft Edge, Opera, Brave, and Vivaldi. Any browser built on the affected Chromium version is vulnerable.
How do I fix CVE-2017-5070?
Update all Chromium-based browsers to the latest patched versions. Enable automatic browser updates and consider deploying browser isolation for defense-in-depth against V8 vulnerabilities.
How severe is CVE-2017-5070?
CVE-2017-5070 is a high-severity type confusion vulnerability with an EPSS score of 71.1% in the 98th percentile. It enables code execution within the browser sandbox through a crafted web page, with confirmed active exploitation in the wild.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.