Actively exploited in the wild
Google Chromium V8 Out-of-Bounds Write Vulnerability
Google - Chromium V8 · Listed in the CISA KEV since 2022-06-08. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2018-17480
HighCVSS 8.8KEVSummary
Execution of user-supplied JavaScript during array deserialization leading to an out-of-bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Risk Assessment
An attacker could remotely execute arbitrary code within the browser context, potentially leading to data theft or further system exploitation. However, user interaction is required, such as visiting a malicious page.
Recommendation
Update Google Chrome to version 71.0.3578.80 or later. Also, regularly update the browser and avoid suspicious websites.
Other vulnerabilities in Google Chrome V8
See all- CVE-2026-8540High
Type Confusion in V8 in Google Chrome prior to version 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2026-7902High
Out of bounds memory access in V8 in Google Chrome prior to version 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2026-7899High
Out of bounds read and write in V8 in Google Chrome prior to version 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2026-6363High
Type Confusion in V8 in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
- CVE-2026-0900High
A vulnerability in the V8 JavaScript engine in Google Chrome prior to 144.0.7559.59 is caused by inappropriate implementation, potentially leading to object corruption. A remote attacker can exploit this by delivering a crafted HTML page.
- CVE-2026-0899High
CVE-2026-0899 is a vulnerability in the V8 engine of Google Chrome prior to version 144.0.7559.59. It involves out-of-bounds memory access, which can lead to object corruption. A remote attacker can exploit this flaw via a crafted HTML page.
- CVE-2017-5122High
Inappropriate handling of table size in V8 in Google Chrome prior to version 61.0.3163.100 for Windows allows a remote attacker to trigger out-of-bounds access via a crafted HTML page.
- CVE-2017-5121High
Inappropriate use of JIT optimisation in V8 in Google Chrome prior to version 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to the escape analysis phase.
- CVE-2017-5116High
Type confusion in V8 in Google Chrome prior to version 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2017-5115High
Type confusion in V8 in Google Chrome prior to version 61.0.3163.79 for Windows allowed a remote attacker to potentially exploit object corruption via a crafted HTML page.
Original NVD description (English source)
Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.