Remote Code Execution Vulnerability in Google Chrome Across Multiple Platforms
CVE-2017-5030

8.8HIGH

Key Information:

Vendor
Google
Status
Google Chrome Prior To 57.0.2987.98 For Linux, Windows And Mac, And 57.0.2987.108 For Android
Vendor
CVE Published:
24 April 2017

Badges

👾 Exploit Exists🟣 EPSS 65%🦅 CISA Reported

Summary

This vulnerability arises from the improper handling of complex species in the V8 JavaScript engine of Google Chrome. An attacker can craft a malicious HTML page that, when opened in a vulnerable version of the browser, can manipulate memory and execute arbitrary code remotely. This flaw affects multiple operating systems including Linux, Windows, Mac, and Android, making it imperative for users to update their browser to the latest version to mitigate potential exploitation.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply updates per vendor instructions.

Affected Version(s)

Google Chrome prior to 57.0.2987.98 for Linux, Windows and Mac, and 57.0.2987.108 for Android Google Chrome prior to 57.0.2987.98 for Linux, Windows and Mac, and 57.0.2987.108 for Android

References

https://chromereleases.googleblog.com/2017/03/stable-chan...
x_refsource_CONFIRM
https://security.gentoo.org/glsa/201704-02
vendor-advisoryx_refsource_GENTOO
https://crbug.com/682194
x_refsource_CONFIRM

EPSS Score

65% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • Vulnerability published

  • Vulnerability Reserved

.