CVE-2018-6065

CVE-2018-6065 is a high-severity integer overflow (CWE-190) in Google's V8 JavaScript engine that occurs when V8 computes the required allocation size while instantiating a new JavaScript object, causing a miscalculated allocation that can corrupt the heap. A remote attacker triggers the flaw by getting a user to open a crafted HTML page in a vulnerable browser, which is why the CVSS vector includes user interaction (UI:R). Successful exploitation can let the attacker exploit heap corruption, potentially achieving code execution in the browser with high impact to confidentiality, integrity, and availability (CVSS 3.1: 8.8). Google Chrome versions prior to 65.0.3325.146 are affected, along with the Chromium-derived products in the CPE data: Red Hat Enterprise Linux Desktop/Server/Workstation, Debian Linux, and the Mi6 Browser from vendor 'mi'. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-06-08) with a very high EPSS score (60.3%, 99th percentile) and public proof-of-concept code exists (crbug.com/808192, Exploit-DB 44584), so in-the-wild exploitation should be assumed; no ransomware association is recorded.

What to do: Upgrade Google Chrome/Chromium to version 65.0.3325.146 or later. On Red Hat Enterprise Linux and Debian, install the updated chromium packages per vendor advisories, and apply Mi6 Browser updates supplied by the vendor. Because the flaw is CISA KEV-listed, treat patching as urgent and verify installed browser versions fleet-wide; as an interim mitigation, caution users against following untrusted links, since exploitation requires loading a crafted HTML page.