CVE-2018-17457: Use After Free

Q: Who is exposed to this vulnerability?

Users of affected Google Chrome or Debian chromium-browser installations are exposed when they browse to an attacker-controlled crafted HTML page. Exploitation can be performed remotely and does not require attacker authentication.

Q: What does successful exploitation allow?

A remote attacker can execute arbitrary code inside the browser sandbox. The reported impact includes high confidentiality, integrity, and availability impact.

Q: Is user interaction required?

Yes. The CVSS vector indicates user interaction is required, consistent with the victim needing to load a crafted HTML page.

Q: What should be done to remediate the issue?

Apply the available patch by updating affected Chrome or Chromium-browser installations. Google Chrome versions prior to 69.0.3497.81 are affected according to the provided data.

Published Jan 9, 2019

Updated

An object lifecycle issue in Blink could lead to a use after free in WebAudio in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Affected Software

2 affected components

Google Chrome<69.0.3497.81

debian/chromium-browser

Remediation

Patch Available

https://crbug.com/848306

Event History

Jan 9, 2019

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

DSA-4289

Frequently Asked Questions

Who is exposed to this vulnerability?

Users of affected Google Chrome or Debian chromium-browser installations are exposed when they browse to an attacker-controlled crafted HTML page. Exploitation can be performed remotely and does not require attacker authentication.

What does successful exploitation allow?

A remote attacker can execute arbitrary code inside the browser sandbox. The reported impact includes high confidentiality, integrity, and availability impact.

Is user interaction required?

Yes. The CVSS vector indicates user interaction is required, consistent with the victim needing to load a crafted HTML page.

What should be done to remediate the issue?

Apply the available patch by updating affected Chrome or Chromium-browser installations. Google Chrome versions prior to 69.0.3497.81 are affected according to the provided data.

CVE-2018-17457: Use After Free

Affected Software

Remediation

Patch Available

Event History

Parent advisories

Frequently Asked Questions

Who is exposed to this vulnerability?

What does successful exploitation allow?

Is user interaction required?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this vulnerability?

What does successful exploitation allow?

Is user interaction required?

What should be done to remediate the issue?