CVE-2018-17463

HIGH8.8

CISA KEV

Published 2018-11-14 · Updated 2026-06-17 · Source chrome-cve-admin@google.com

Summary

CVE-2018-17463 is a high-severity (CVSS 8.8) vulnerability in Google Chromium V8. CISA added it to the Known Exploited Vulnerabilities catalog on June 8, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by June 22, 2022. CISA does not currently list it as used in ransomware campaigns. Google has 75 vulnerabilities in the KEV catalog, 0 of them linked to ransomware.

All 75 known-exploited Google vulnerabilities →

Description

Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA Known-Exploited Vulnerability

Product: Google — Chromium V8

Name: Google Chromium V8 Remote Code Execution Vulnerability

Date added: 2022-06-08 · Due: 2022-06-22

Required action: Apply updates per vendor instructions.

References

View on NVD

More exploited Google vulnerabilities

Most recently added to CISA KEV

CVE-2026-58704
Pixel — Google Pixel Improper Authorization Vulnerability
added 2026-09-16
CVE-2026-87491
Chromium V8 — Google Chromium V8 Out of Bounds Write Vulnerability
added 2026-09-09
CVE-2026-85046
Chromium V8 — Google Chromium V8 Type Confusion Vulnerability
added 2026-09-04
CVE-2026-11645
Chromium V8 — Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
added 2026-06-09
CVE-2026-5281
Dawn — Google Dawn Use-After-Free Vulnerability
added 2026-04-01
CVE-2026-3910
Chromium V8 — Google Chromium V8 Improper Restriction of Operations Within the Bounds of a Memory Buffer Vulnerability
added 2026-03-13

View all →

Related CVEs

Same severity, most recent

CVE-2026-76665
A security vulnerability in HPE NonStop EXPAND may cause out-of-bounds memory read resulting in buffer overflow.
2026-10-15 · score 7.1
CVE-2026-3712
The PhastPress plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.10 This is due to the scripts service endpoint constructing its URL whitelist dynamically from the attacker-controlled HTTP 'Host' header. This makes it possible for unauthenticated attackers to spoof the header to match any target URL, bypassing the whitelist and forcing the server to make HTTP requests to arbitrary internal or external destinations and return the response content.
2026-10-15 · score 7.3
CVE-2026-76663
A stack-based buffer overflow vulnerability in HPE NonStop TELSERV can cause memory corruption that may result in DoS.
2026-10-15 · score 7.5
CVE-2026-110908
Netgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR status filter. An authenticated WebGUI user with only the page-status-frr privilege can supply a filter value that breaks out of a single-quoted sed expression into which escapeshellarg() output is concatenated. Shell command substitution is then evaluated by a popen() pipeline, allowing attacker-selected commands to execute as root. There are updated FRR packages for pfSense Plus 26.07/26.03.1 and CE 2.9.0/2.8.1.
2026-10-15 · score 8.8
CVE-2026-110907
Backdrop CMS Core 1.35.x before 1.35.2 and 1.34.x before 1.34.6 mishandles tokens. A token is a small placeholder string (like [node:title] or [user:name]) used to automatically insert dynamic data into text. A browser is provided for selecting tokens by type. The product doesn't sufficiently limit access to the types of tokens that are available in the token browser. The names of the individual tokens are adequately protected.
2026-10-15 · score 7.5