CVE-2018-17480
Google Chromium V8 Out-of-Bounds Write Vulnerability
Description
CVE-2018-17480 is an out-of-bounds write vulnerability in the Google Chromium V8 JavaScript engine that allows a remote attacker to execute code inside the browser sandbox via a crafted HTML page. The flaw enables an attacker to write data beyond the intended buffer boundaries in V8, corrupting heap memory and achieving code execution within the renderer process. This vulnerability affects multiple Chromium-based browsers including Google Chrome, Microsoft Edge, and Opera. CISA has added CVE-2018-17480 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 27.0% (96th percentile), this Chromium V8 out-of-bounds write vulnerability poses a significant security risk.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 71.0.3578.80 | |
| redhat | enterprise linux desktop | 6.0 |
| redhat | enterprise linux server | 6.0 |
| redhat | enterprise linux workstation | 6.0 |
| debian | debian linux | 9.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/106084(Broken Link, Third Party Advisory, VDB Entry)
- https://access.redhat.com/errata/RHSA-2018:3803(Third Party Advisory)
- https://chromereleases.googleblog.com/2018/12/stable-channel-update-for-desktop.html(Vendor Advisory)
- https://crbug.com/905940(Exploit, Issue Tracking)
- https://security.gentoo.org/glsa/201908-18(Third Party Advisory)
- https://www.debian.org/security/2018/dsa-4352(Mailing List, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-17480(US Government Resource)
Weakness Type
CWE-787: Out-of-bounds Write
CVE-2018-17480 exploits an out-of-bounds write vulnerability in the Chromium V8 engine, where the JavaScript engine writes data past the allocated buffer boundary during processing of crafted JavaScript code. This out-of-bounds write enables heap memory corruption, which can be leveraged by an attacker to hijack control flow and execute arbitrary code within the browser sandbox.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2018-17480 allows remote code execution within the Chromium browser sandbox through a crafted web page, requiring no authentication and only that a user navigates to attacker-controlled content. The out-of-bounds write in V8 enables heap corruption that can be escalated to code execution within the renderer process. Confidentiality and integrity are significantly impacted within the sandbox context, as the attacker can access browser-stored data including cookies, session tokens, and cached credentials. While the initial execution occurs within the sandbox, the vulnerability could serve as the first stage of a multi-exploit chain achieving full system compromise. The EPSS score of 27.0% (96th percentile) indicates high exploitation probability, and the cross-browser impact across all Chromium-based browsers broadens the threat landscape significantly.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2018-17480 by including it in the Known Exploited Vulnerabilities catalog, with a remediation deadline of June 22, 2022. The EPSS score of 27.0% (96th percentile) reflects substantial exploitation activity. No specific ransomware campaigns have been attributed to this vulnerability. However, V8 out-of-bounds write vulnerabilities are commonly used in sophisticated browser exploit chains, often combined with sandbox escape vulnerabilities to achieve full system compromise in watering hole attacks and targeted exploitation campaigns.
Remediation
- Update all Chromium-based browsers immediately to versions that address CVE-2018-17480, including Google Chrome, Microsoft Edge, and Opera.
- Enable automatic browser updates on all managed endpoints to ensure security patches are applied without delay.
- Deploy browser isolation technology to execute web content in isolated environments, preventing V8 exploits from impacting organizational systems.
- Implement web filtering to block access to known malicious domains and exploit delivery infrastructure.
- Monitor for browser exploitation indicators in endpoint detection telemetry, including unexpected renderer crashes, anomalous process trees spawned by browsers, or network connections to command-and-control infrastructure following browser activity.
Technical Details
CVE-2018-17480 is an out-of-bounds write vulnerability in the V8 JavaScript engine embedded in Chromium-based browsers. The vulnerability is triggered when V8 processes specifically crafted JavaScript that causes the engine to write data beyond the boundaries of an allocated heap buffer. The out-of-bounds write overwrites adjacent heap objects or metadata, which an attacker can exploit through careful heap layout manipulation to place controlled data at predictable memory locations. By overwriting critical data structures such as object maps, array lengths, or function pointers, the attacker establishes a reliable code execution primitive within the Chromium renderer process. The crafted HTML page containing the malicious JavaScript can be delivered through any web content rendering scenario, making drive-by exploitation straightforward.
Frequently Asked Questions
Is CVE-2018-17480 being actively exploited?
Yes. CISA has confirmed active exploitation by including it in the KEV catalog. The EPSS score of 27.0% (96th percentile) indicates high exploitation probability. V8 out-of-bounds write vulnerabilities are commonly used in browser-based attack campaigns.
What products are affected by CVE-2018-17480?
CVE-2018-17480 affects all Chromium-based browsers including Google Chrome, Microsoft Edge, Opera, Brave, and Vivaldi. Any browser using the vulnerable V8 engine version is susceptible.
How do I fix CVE-2018-17480?
Update all Chromium-based browsers to the latest patched versions. Enable automatic updates and consider deploying browser isolation for additional protection against V8 vulnerabilities.
How severe is CVE-2018-17480?
CVE-2018-17480 is a high-severity out-of-bounds write vulnerability with an EPSS score of 27.0% in the 96th percentile. It enables code execution within the browser sandbox through a crafted web page, affecting all Chromium-based browsers.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.