CVE-2017-5030 describes a critical arbitrary code execution vulnerability in Google Chrome's V8 JavaScript engine, affecting versions prior to 57.0.2987.98 on Linux, Windows, and Mac, and 57.0.2987.108 on Android, as well as various other products from Apple, Debian, Microsoft, and Red Hat. This flaw, stemming from incorrect handling of complex species, allowed a remote attacker to execute arbitrary code by enticing a user to visit a specially crafted HTML page. With a CVSS score of 8.8 (HIGH) and a FAUCET Risk Score of 100/100, the vulnerability is easily exploitable over the network with low attack complexity, leading to complete compromise of confidentiality, integrity, and availability. Notably, this CVE has been actively exploited in the wild and has garnered significant community discussion, despite the absence of public Metasploit or ExploitDB modules.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 57.0.2987.98CPE matchmatch criteria | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | ||
< 57.0.2987.108CPE matchmatch criteria | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | ||
8.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:* | ||
9.0CPE matchmatch criteria | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | ||
6.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.2 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.1 Security Researcher mentions.