CVE-2017-5030KEV · OVERDUE

Google Chromium V8 Memory Corruption Vulnerability

High · published April 24, 2017

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 98.6th percentile for exploit probability.

1584
days past CISA
deadline
CVSS v3.1
8.8
EPSS
41%
Percentile
98.6
In the wild
Confirmed
What it is

🚨 A crafted HTML page is all it takes to execute arbitrary code in your browser! This vulnerability has been tagged as high risk, and it’s time to take action! ⚡ Think of it like a gourmet chef slipping a secret ingredient into your dish without you knowing — suddenly, your meal can have unexpected flavors, or worse, a full-on disaster! This vulnerability in Chrome's V8 engine lets attackers add their own ‘ingredients’ to run malicious code on your system. An attacker could exploit this vulnerability to execute any code they choose, potentially gaining control over the victim's machine. This means they can access sensitive information, install malware, or cause general chaos on your device, all while you think you’re just browsing the web.

Put simply

Think of it like a gourmet chef slipping a secret ingredient into your dish without you knowing — suddenly, your meal can have unexpected flavors, or worse, a full-on disaster! This vulnerability in Chrome's V8 engine lets attackers add their own ‘ingredients’ to run malicious code on your system. The vulnerability arises from incorrect handling of complex species within the V8 engine of Google Chrome, allowing a remote attacker to execute arbitrary code through specially crafted HTML pages.

What to do

An attacker could exploit this vulnerability to execute any code they choose, potentially gaining control over the victim's machine. This means they can access sensitive information, install malware, or cause general chaos on your device, all while you think you’re just browsing the web. To protect yourself, immediately update Google Chrome to version 57.0.2987.98 or later for Linux, Windows, and Mac, or 57.0.2987.108 for Android. Regularly check for updates and ensure they are applied promptly to maintain security. You’ve got this! Just update your browser, and you’ll be back to safe browsing in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.40635 · 98.6th percentile
Published
2017-04-24T23:00Z
KEV added
2022-06-08 · due 2022-06-22
EPSS history
Timeline
  • 08 JUN 00:00Z
    Added to CISA KEV — remediate by Jun 22
    kev
  • 24 APR 23:00Z
    Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote…
    cvelistv5