Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Chrome on Mac before 68 can be hijacked via web page

CVE-2018-6162 · published 7 years ago
Summary

Google Chrome running on macOS versions earlier than 68.0.3440.75 can be tricked by a specially crafted web page into corrupting memory, which could let an attacker take control of the browser. This risk also applies to Chrome installations on Debian and Red Hat Linux systems that use the same vulnerable component. Update Chrome to the latest version as soon as possible to close the issue.

What to do
  • Update google chrome to version 68.0.3440.75 or later.
Affected software
VendorProductAffected versions
google chrome < 68.0.3440.75
cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*
debian debian_linux 9.0
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
redhat enterprise_linux_desktop 6.0
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_server 6.0
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
redhat enterprise_linux_workstation 6.0
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
Original advisory text
Improper deserialization in WebGL in Google Chrome on Mac prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Improper deserialization in WebGL in Google Chrome on Mac prior to 68.0.3440.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
2% chance of attack within 30 days
Type
CWE-502Deserialization of Untrusted Data
CWE-787Out-of-bounds Write
Timeline
Published9 Jan 2019
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2018-6162 · NVD
Track software like this
Free during beta