{"id":"CVE-2018-17463","kind":"vulnerability","aliases":["CVE-2018-17463"],"related":[],"title":"Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute…","description":"Google Chromium V8 Engine contains an unspecified vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.\n\nCISA required action: Apply updates per vendor instructions.","summary":"A flaw in the V8 JavaScript engine used by Chromium lets a remote attacker run code inside the browser sandbox by serving a crafted HTML page. Attackers are actively exploiting it, per CISA's Known Exploited Vulnerabilities catalog.","severity":"high","cvss":8.8,"epss":0.84564,"exploited":true,"exploited_at":"2022-06-08T00:00:00+00:00","products":[{"name":"Google Chromium V8","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"google chrome","fixed":["70.0.3538.67"],"affected":"< 70.0.3538.67","ecosystem":"vendor"},{"name":"redhat enterprise linux desktop","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"redhat enterprise linux server","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"redhat enterprise linux workstation","fixed":[],"affected":"= 6.0","ecosystem":"vendor"},{"name":"debian linux","fixed":[],"affected":"= 9.0","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["browser-users","chrome","chromium","edge","exploited","opera","runtime"],"not_affected_if":["fully-patched-browser"],"how_to_check":"Open chrome://version (or edge://version, opera://version) and compare the Chromium version with the fixed release in the vendor advisory.","fix":"Update Chrome, Edge, Opera or other Chromium-based browsers to a release that includes the vendor fix (CISA: apply updates per vendor instructions).","status":"open","published_at":"2018-11-14T15:29:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:12:36+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-23T21:12:36Z","model":"claude-haiku-5-5","output":{"fix":"Update Chrome, Edge, Opera or other Chromium-based browsers to a release that includes the vendor fix (CISA: apply updates per vendor instructions).\nunknown","reach":"internet","impact":"high","summary":"A flaw in the V8 JavaScript engine used by Chromium lets a remote attacker run code inside the browser sandbox by serving a crafted HTML page. Attackers are actively exploiting it, per CISA's Known Exploited Vulnerabilities catalog.","category":"runtime","who_cares":["chromium","chrome","edge","opera","browser-users"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker runs code inside the browser sandbox on a visited page","analyst_note":"Find the fixed Chromium version and the vendor advisory for CVE-2018-17463 to fill in how_to_check and fix; the sources give neither.","how_to_check":"Open chrome://version (or edge://version, opera://version) and compare the Chromium version with the fixed release in the vendor advisory.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["fully-patched-browser"],"user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000507,"input_tokens":2888,"output_tokens":436,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-17463':21A,24A '-2018':20A,23A '70.0.3538.64':12A 'action':138C 'activ':81B 'affect':118C 'allow':13A,100C 'annot':4A 'appli':139C 'attack':16A,66B,79B,103C 'browser':45B,71B,121C 'browser-us':44B 'catalog':90B 'chrome':9A,29A,47B,131C 'chromium':26A,48B,62B,92C,124C 'cisa':85B,136C 'code':68B,106C 'contain':95C 'could':117C 'craft':76B,112C 'cve':19A,22A 'debian':42A 'desktop':33A 'edg':49B,133C 'effect':3A 'engin':59B,94C 'enterprise':31A,35A,39A 'execut':18A,105C 'exploit':50B,82B,88B 'flaw':54B 'googl':8A,91C,130C 'google':25A,28A 'html':77B,113C 'includ':125C 'incorrect':1A 'insid':69B,107C 'instruct':143C 'javascript':58B 'known':87B 'let':63B 'limit':128C 'linux':32A,36A,40A,43A 'microsoft':132C 'multipl':119C 'opera':51B,135C 'page':78B,114C 'per':84B,141C 'prior':10A 'redhat':30A,34A,38A 'remot':15A,65B,102C 'requir':137C 'run':67B 'runtim':52B 'sandbox':72B,109C 'serv':74B 'server':37A 'side':2A 'unspecifi':97C 'updat':140C 'use':60B 'user':46B 'util':123C 'v8':6A,27A,57B,93C 'vendor':142C 'via':110C 'vulner':89B,98C,116C 'web':120C 'workstation':41A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-11-14T15:29:00+00:00","kev":{"dateAdded":"2022-06-08","dueDate":"2022-06-22","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-17463","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-17463","severity":null,"published_at":"2022-06-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T11:39:16+00:00","note":null},{"source":"epss","external_id":"CVE-2018-17463","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-17463","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-17463","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-17463","severity":null,"published_at":"2018-11-14T15:29:00+00:00","modified_at":"2026-06-17T01:45:53+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}