CVE-2017-15416

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Heap buffer overflow in Blob API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page, aka a Blink out-of-bounds read.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-119

Affected software

No affected versions have been published.

Timeline

Published
Aug 28, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-154175.3Inappropriate implementation in Skia canvas composite operations in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak crCVE-2017-154184.3Use of uninitialized memory in Skia in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to obtain potentially sensitive informaCVE-2017-154196.5Insufficient policy enforcement in Resource Timing API in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to infer browsing hiCVE-2017-154206.5Incorrect handling of back navigations in error pages in Navigation in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to spooCVE-2017-154226.5Integer overflow in international date handling in International Components for Unicode (ICU) for C/C++ before 60.1, as used in V8 in GoogleCVE-2017-154235.3Inappropriate implementation in BoringSSL SPAKE2 in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to leak the low-order bitsCVE-2017-154246.5Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via ICVE-2017-154256.5Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via ICVE-2017-154266.5Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a remote attacker to perform domain spoofing via ICVE-2017-154276.1Insufficient policy enforcement in Omnibox in Google Chrome prior to 63.0.3239.84 allowed a socially engineered user to XSS themselves by drCVE-2017-154288.8Insufficient data validation in V8 builtins string generator could lead to out of bounds read and write access in V8 in Google Chrome prior CVE-2017-154296.1Inappropriate implementation in V8 WebAssembly JS bindings in Google Chrome prior to 63.0.3239.108 allowed a remote attacker to inject arbit
CVE-2017-15416: Medium severity, CVSS 6.5 | Vulnix