CVE-2018-17480

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

No affected versions have been published.

Timeline

Published
Dec 11, 2018
Last modified
Jun 17, 2026
Added to CISA KEV
Jun 8, 2022
NVD status
Analyzed

Related CVEs from 2018

CVE-2018-174818.8Incorrect object lifecycle handling in PDFium in Google Chrome prior to 71.0.3578.98 allowed a remote attacker to potentially exploit heap cCVE-2018-174825.5Lobby Track Desktop could allow a local attacker to obtain sensitive information, caused by an error in Reports while in kiosk mode. By visiCVE-2018-174835.5Lobby Track Desktop could allow a local attacker to obtain sensitive information, caused by an error in Reports while in kiosk mode. By visiCVE-2018-174847.1Lobby Track Desktop could allow a local attacker to obtain sensitive information, caused by an error in Sample Database.mdb database while iCVE-2018-174857.8Lobby Track Desktop contains default administrative credentials. An attacker could exploit this vulnerability to gain full access to the appCVE-2018-174865.5Lobby Track Desktop could allow a local attacker to bypass security restrictions, caused by an error in the find visitor function while in kCVE-2018-174877.8Lobby Track Desktop could allow a local attacker to gain elevated privileges on the system, caused by an error in the printer dialog. By visCVE-2018-174887.8Lobby Track Desktop could allow a local attacker to gain elevated privileges on the system, caused by an error in the printer dialog. By visCVE-2018-174895.5EasyLobby Solo could allow a local attacker to obtain sensitive information, caused by the storing of the social security number in plaintexCVE-2018-17496.5IBM Tivoli Key Lifecycle Manager 2.6, 2.7, and 3.0 uses incomplete blacklisting for input validation which allows attackers to bypass applicCVE-2018-174907.1EasyLobby Solo is vulnerable to a denial of service. By visiting the kiosk and accessing the task manager, a local attacker could exploit thCVE-2018-174917.8EasyLobby Solo could allow a local attacker to gain elevated privileges on the system. By visiting the kiosk and typing "esc" to exit the pr