⚠ Actively exploited

Added to CISA KEV on 2022-06-08. Federal agencies required to patch by 2022-06-22. Required action: Apply updates per vendor instructions..

CVE-2017-5070 — Type Confusion in Google Chrome

CWE-843 — Type Confusion14 documents9 sources

Severity

8.8HIGHNVD

EPSS

71.1%

top 1.29%

CISA KEV

KEV

Added 2022-06-08

Due 2022-06-22

Exploit

Exploited in wild

Active exploitation observed

Affected products

Google Chrome Redhat Enterprise Linux Desktop Redhat Enterprise Linux Server +1 more

Timeline

PublishedOct 27

KEV addedJun 8

KEV dueJun 22

Latest updateDec 5

CISA Required Action: Apply updates per vendor instructions.

Description

Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

▶NVDgoogle/chrome< 59.0.3071.86+1

▶NVDredhat/enterprise_linux_server6.0

▶NVDredhat/enterprise_linux_desktop6.0

▶NVDredhat/enterprise_linux_workstation6.0

🔴Vulnerability Details

GHSA

GHSA-g97f-3hrx-c447: Type confusion in V8 in Google Chrome prior to 59↗2022-05-13

▶

Project0

In-the-Wild Series: Chrome Exploits - Project Zero↗2021-01-01

▶

OSV

CVE-2017-5070: Type confusion in V8 in Google Chrome prior to 59↗2017-10-27

▶

VulnCheck

Google Chromium V8 Type Confusion Vulnerability↗2017

▶

📋Vendor Advisories

CISA

Google Chromium V8 Type Confusion Vulnerability↗2022-06-08

▶

Red Hat

chromium-browser: type confusion in v8↗2017-06-05

▶