Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Chrome before 61 may run code from malicious web page

CVE-2017-5121 · published 9 years ago
Summary

Google Chrome versions earlier than 61 can be tricked by a specially crafted web page to execute code inside the browser sandbox. This could let a remote attacker run unwanted programs on a user's computer. Updating Chrome to version 61.0.3163.100 or newer fixes the issue.

What to do
  • Update google chrome to version 61.0.3163.100 or later.
Affected software
VendorProductAffected versions
google chrome < 61.0.3163.100
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
debian debian_linux 9.0
10.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
redhat enterprise_linux_desktop 6.0
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_server 6.0
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_workstation 6.0
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
Original advisory text
Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HT...
Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to the escape analysis phase.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
5% chance of attack within 30 days
Type
CWE-20Improper Input Validation
Timeline
Published27 Oct 2017
Updated22 Oct 2026
First seen29 Sep 2026
Sources
CVE-2017-5121 · NVD
Track software like this
Free during beta