CVE-2018-17463
HIGH KEVGoogle Chrome < 70.0.3538.64 - Remote Code Execution via V8 Side Effect Annotation
Title source: llmExploitation Summary
CVE-2018-17463 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added June 8, 2022.
EIP tracks 4 public exploits from researchers including Metasploit, jhalon, kdmarti2, including a Metasploit module exploits/multi/browser/chrome_object_create.
AI-analyzed exploit summary This Metasploit module exploits a type confusion vulnerability in Google Chrome's JIT compiler (CVE-2018-17463) by manipulating Object.create to confuse PropertyArray and NameDictionary types, leading to arbitrary memory read/write and RCE in the sandboxed renderer process.
Description
Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Exploits (4)
This Metasploit module exploits a type confusion vulnerability in Google Chrome's JIT compiler (CVE-2018-17463) by manipulating Object.create to confuse PropertyArray and NameDictionary types, leading to arbitrary memory read/write and RCE in the sandboxed renderer process.
This is a working proof-of-concept exploit for CVE-2018-17463, leveraging a type confusion vulnerability in V8 to achieve arbitrary memory read/write and execute shellcode via WebAssembly RWX pages. The exploit demonstrates a full chain from primitive development to RCE by popping a calculator.
This is a working exploit for CVE-2018-17463, a type confusion vulnerability in V8 JavaScript engine. It achieves arbitrary read/write and executes a shellcode payload to spawn a shell.
This Metasploit module exploits a type confusion vulnerability in Google Chrome's JIT compiler (CVE-2018-17463) and optionally uses CVE-2019-1458 for sandbox escape on Windows 7. It achieves remote code execution by manipulating Object.create to confuse PropertyArray and NameDictionary types.
References (8)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H