CVE-2018-6092

HIGH

Google Chrome <66.0.3359.117 - RCE

Title source: llm

Description

An integer overflow on 32-bit systems in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Exploits (1)

exploitdb WORKING POC VERIFIED

by Google Security Research · javascriptdosmultiple

https://www.exploit-db.com/exploits/44860

View Code ZIP pw:eip

References (7)

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2018:1195

[Release Notes, Vendor Advisory] https://chromereleases.googleblog.com/2018/04/stable-channel-update-for-desktop.html

[Issue Tracking] https://crbug.com/819869

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/103917

[Exploit, Third Party Advisory] https://www.exploit-db.com/exploits/44860/

[Third Party Advisory] https://www.debian.org/security/2018/dsa-4182

[Third Party Advisory] https://security.gentoo.org/glsa/201804-22

Scores

CVSS v3 8.8

EPSS 0.1834

EPSS Percentile 95.2%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE

CWE-190

Status published

Products (6)

debian/debian_linux 8.0

debian/debian_linux 9.0

google/chrome < 66.0.3359.117

redhat/linux_desktop 6.0

redhat/linux_server 6.0

redhat/linux_workstation 6.0

Published Dec 04, 2018

Tracked Since Feb 18, 2026