CVE-2018-17480

CVE-2018-17480 is an out-of-bounds write (CWE-787) in Google's Chromium V8 JavaScript engine, the component that executes web page scripts in Chromium-based browsers. An attacker triggers it by inducing a user to load a crafted HTML page, causing V8 to write past the end of an in-memory buffer in the browser's renderer process. A successful attacker can execute code inside the browser's renderer sandbox; escaping to fully compromise the underlying system would generally require a separate sandbox-escape bug. Anyone using browsers or applications built on the affected Chromium/V8 code is affected, and CISA notes this could include Google Chrome, Microsoft Edge, and Opera. The flaw is listed in CISA's KEV catalog (added 2022-06-08), confirming exploitation in the wild, with a 35.6% EPSS probability of exploitation within 30 days (98th percentile), no public proof-of-concept known, and no confirmed ransomware association.

What to do: Follow CISA's required action and update Google Chrome, Microsoft Edge (Chromium builds), Opera, and any other Chromium- or V8-embedding software to the latest vendor releases, which incorporate the patched V8; no specific version numbers are provided in the source data. Verify update status via each browser's about/settings page and inventory any applications that embed Chromium/V8 on the network. Because the attack vector is loading a crafted web page, web content filtering reduces exposure, but patching is the definitive fix.