CVE-2017-5070KEV · OVERDUE

Google Chromium V8 Type Confusion Vulnerability

High · published October 27, 2017

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 98.3th percentile for exploit probability.

1583
days past CISA
deadline
CVSS v3.1
8.8
EPSS
32%
Percentile
98.3
In the wild
Confirmed
What it is

🚨 A crafty HTML page can unleash chaos in Google Chrome, allowing remote attackers to execute arbitrary code! 🔥 Think of this vulnerability like a magician slipping a dodgy card into a game of poker — it lets the attacker manipulate the game from behind the scenes, completely undermining its integrity. If exploited, an attacker could take full control of your browser environment, accessing sensitive data, installing malware, or even gaining control of the entire system. This could be an absolute nightmare for personal and organizational security, making it a prime target for cybercriminals!

Put simply

Think of this vulnerability like a magician slipping a dodgy card into a game of poker — it lets the attacker manipulate the game from behind the scenes, completely undermining its integrity. This type confusion flaw in the V8 JavaScript engine allows attackers to execute arbitrary code from within a sandboxed environment by simply tricking the browser into mishandling data types.

What to do

If exploited, an attacker could take full control of your browser environment, accessing sensitive data, installing malware, or even gaining control of the entire system. This could be an absolute nightmare for personal and organizational security, making it a prime target for cybercriminals! Update Google Chrome to version 59.0.3071.86 or later for Linux, Windows, and Mac, and version 59.0.3071.92 for Android immediately. Regularly check for updates to ensure your browser remains secure against emerging threats. You've got this! With a few quick updates, you can keep your browsing safe and secure. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.32071 · 98.3th percentile
Published
2017-10-27T05:00Z
KEV added
2022-06-08 · due 2022-06-22
EPSS history
Timeline
  • 08 JUN 00:00Z
    Added to CISA KEV — remediate by Jun 22
    kev
  • 27 OCT 05:00Z
    Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute…
    cvelistv5