Execution of user supplied Javascript during object deserialization can update object length leading to an out of bounds write in V8 in Goo…

Published 7 y ago 2018-12-11 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.8

v3.0 · NVD

CISA KEV

not known exploited

EPSS

2.7%

percentile 86%

Public exploits

none known

Execution of user supplied Javascript during object deserialization can update object length leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Exploit prediction (EPSS)

2.65% probability of exploitation in the next 30 days, higher than 86% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	8.8	`CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H`
NVD	2.0	6.8	`AV:N/AC:M/Au:N/C:P/I:P/A:P`

Affected products

Google Chrome

Classification

Weakness

CWE-787 Out-of-bounds Write

Technology feeds

Google Chrome (RSS, critical only)

References

crbug.com /906313 · x_refsource_MISC, x_transferred
chromereleases.googleblog.com /2018/12/stable-channel-update-for-desktop.html · x_refsource_CONFIRM, x_transferred
access.redhat.com /errata/RHSA-2018:3803 · vendor-advisory, x_refsource_REDHAT, x_transferred
debian.org /security/2018/dsa-4352 · vendor-advisory, x_refsource_DEBIAN, x_transferred
securityfocus.com /bid/106084 · vdb-entry, x_refsource_BID, x_transferred
security.gentoo.org /glsa/201908-18 · vendor-advisory, x_refsource_GENTOO, x_transferred

Sources

CVE List: CVE-2018-18342
NVD: CVE-2018-18342

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.