CVE-2018-6065
Google Chromium V8 Integer Overflow Vulnerability
Description
CVE-2018-6065 is an integer overflow vulnerability in the Google Chromium V8 JavaScript engine that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. The integer overflow leads to incorrect memory allocation sizes, enabling heap-based buffer overflows that can be leveraged for arbitrary code execution. This vulnerability affects multiple Chromium-based web browsers including Google Chrome, Microsoft Edge, and Opera. CISA has added CVE-2018-6065 to its Known Exploited Vulnerabilities catalog, and with an EPSS score of 87.5% (99th percentile), this Chromium V8 vulnerability represents a critical browser security threat.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 65.0.3325.146 | |
| redhat | enterprise linux desktop | 6.0 |
| redhat | enterprise linux server | 6.0 |
| redhat | enterprise linux workstation | 6.0 |
| debian | debian linux | 9.0 |
| mi | mi6 browser | - |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://www.securityfocus.com/bid/103297(Broken Link, Third Party Advisory, VDB Entry)
- https://access.redhat.com/errata/RHSA-2018:0484(Third Party Advisory)
- https://chromereleases.googleblog.com/2018/03/stable-channel-update-for-desktop.html(Release Notes, Vendor Advisory)
- https://crbug.com/808192(Exploit, Issue Tracking)
- https://www.debian.org/security/2018/dsa-4182(Mailing List, Third Party Advisory)
- https://www.exploit-db.com/exploits/44584/(Exploit, Third Party Advisory, VDB Entry)
- https://www.zerodayinitiative.com/advisories/ZDI-19-367/(Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-6065(US Government Resource)
Weakness Type
CWE-190: Integer Overflow or Wraparound
CVE-2018-6065 exploits an integer overflow vulnerability in the Chromium V8 engine, where an arithmetic operation produces a value exceeding the maximum for the target integer type, causing it to wrap around to a small number. This miscalculated value is then used for memory allocation, resulting in an undersized buffer that is subsequently overflowed when actual data is written, enabling heap corruption and potential code execution.
Learn more: CWE-190 — Integer Overflow or Wraparound
Impact Analysis
CVE-2018-6065 is a critical vulnerability in the Chromium V8 JavaScript engine that is remotely exploitable through a crafted HTML page, requiring no authentication and only that a user visits a malicious web page. The integer overflow leads to heap corruption, which sophisticated attackers can reliably exploit for arbitrary code execution within the browser renderer process. Confidentiality and integrity are critically impacted — successful exploitation allows reading sensitive browser data including cookies, saved passwords, and session tokens, as well as executing malicious code. The EPSS score of 87.5% (99th percentile) indicates an extremely high probability of exploitation, reflecting the attractiveness of V8 integer overflow vulnerabilities to exploit developers. The broad attack surface across all Chromium-based browsers and the low barrier to exploitation — simply visiting a web page — makes this a particularly dangerous vulnerability for enterprise environments.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2018-6065 by including it in the Known Exploited Vulnerabilities catalog, with a remediation deadline of June 22, 2022. The EPSS score of 87.5% (99th percentile) reflects extremely high exploitation probability. No specific ransomware campaigns have been publicly attributed to this vulnerability, but integer overflow vulnerabilities in V8 are prime targets for exploit kit developers and advanced persistent threat groups who use them in browser-based exploit chains for targeted attacks and drive-by download campaigns. The proven exploitability of V8 integer overflows for heap corruption makes this a high-confidence exploit vector.
Remediation
- Update all Chromium-based browsers immediately to versions that address CVE-2018-6065, including Google Chrome, Microsoft Edge, Opera, and other Chromium-derived browsers.
- Enable automatic browser updates on all managed endpoints to ensure V8 security patches are applied promptly.
- Deploy browser isolation or sandboxing solutions that render web content in isolated environments, preventing V8 heap corruption exploits from impacting the host system.
- Implement network-level protections including web content filtering and URL categorization to block access to known exploit delivery infrastructure.
- Monitor endpoint telemetry for browser exploitation indicators such as abnormal memory allocation patterns, unexpected child processes spawned by browser processes, or browser crashes that could indicate exploitation attempts targeting V8 integer overflow vulnerabilities.
Technical Details
CVE-2018-6065 is an integer overflow vulnerability in the V8 JavaScript engine used by Chromium-based browsers. The vulnerability occurs when V8 performs arithmetic operations on integer values during JavaScript execution, and a specifically crafted calculation causes the result to exceed the maximum value representable by the integer type, wrapping around to a small positive number. When this incorrectly small value is subsequently used as a size parameter for heap memory allocation, the allocated buffer is significantly smaller than expected. When V8 then writes the actual data into this undersized buffer, a heap-based buffer overflow occurs, corrupting adjacent heap metadata and objects. An attacker can leverage this corruption through heap grooming techniques to control execution flow, achieving arbitrary code execution within the Chromium renderer process sandbox.
Frequently Asked Questions
Is CVE-2018-6065 being actively exploited?
Yes. CISA has added CVE-2018-6065 to its Known Exploited Vulnerabilities catalog, confirming active exploitation. The EPSS score of 87.5% (99th percentile) indicates extremely high exploitation probability. While no specific ransomware association exists, V8 integer overflow exploits are used by advanced threat groups.
What products are affected by CVE-2018-6065?
CVE-2018-6065 affects all Chromium-based browsers including Google Chrome, Microsoft Edge, Opera, Brave, and Vivaldi. Any browser using the vulnerable version of the V8 JavaScript engine is susceptible when processing a crafted HTML page.
How do I fix CVE-2018-6065?
Update all Chromium-based browsers to the latest patched versions that address this V8 integer overflow vulnerability. Enable automatic updates on all managed endpoints and consider deploying browser isolation technology for additional protection.
How severe is CVE-2018-6065?
CVE-2018-6065 is a critical integer overflow vulnerability with an EPSS score of 87.5% in the 99th percentile. It enables remote code execution through a crafted web page with no user action beyond visiting the page, affecting all Chromium-based browsers. Its confirmed active exploitation makes this a high-priority remediation target.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.