CVE-2017-5070: Google Chromium V8 Type Confusion Vulnerability
A type confusion flaw was found in the V8 component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=722756
External References:
https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html
Other sources
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to execute code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
— CISA
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/Chrometo a version that resolves this vulnerability.Fixed in 59.0.3071.86 - Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 59.0.3071.86 - Upgrade
Upgrade
Chromium/V8 (Google Chrome/Edge/Opera affected via Chromium)to a version that resolves this vulnerability.Fixed in 59.0.3071.86 - Upgrade
Upgrade
Chromium/V8 (Google Chrome/Edge/Opera affected via Chromium)to a version that resolves this vulnerability.Fixed in 59.0.3071.92
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2017-5070?
CVE-2017-5070 is a vulnerability in the Google Chromium V8 engine that allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Which software are affected by CVE-2017-5070?
CVE-2017-5070 affects Google Chrome prior to version 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android.
What is the severity of CVE-2017-5070?
CVE-2017-5070 has a severity rating of 8.8 (high).
How can I fix CVE-2017-5070?
To fix CVE-2017-5070, update Google Chrome to version 59.0.3071.86 for Linux, Windows, and Mac, or version 59.0.3071.92 for Android.
Where can I find more information about CVE-2017-5070?
You can find more information about CVE-2017-5070 at the following references: [Google Code Issue](https://code.google.com/p/chromium/issues/detail?id=722756), [Google Chrome Releases](https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html), [Redhat Bugzilla](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1459040).