CVE DatabaseCVE-2017-5070

Updated 2026-06-17한국어 권고문 →

CVE-2017-50708.8/HIGHCISA KEVCWE-843CWE-843

Google Chrome V8 Engine Type Confusion Remote Code Execution Vulnerability (CVE-2017-5070)

⚡ Jump to Patch

Affected Vendors

google

Affected Components

chrome, v8

Published Date

2017-10-27

CVSS v3.1

8.8

HIGH

EPSS (30d)

32.1%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Google Chrome prior to 59.0.3071.86 for Linux, Windows, and macOS, and prior to 59.0.3071.92 for Android

Impact

A remote attacker can execute arbitrary code within the Chrome renderer sandbox by enticing a user to visit a specially crafted HTML page

Mitigation

Immediately update Google Chrome to the latest stable version (59.0.3071.86 or higher) and enforce automatic updates across the enterprise

Affected Products & Version Scope

Google Chrome prior to 59.0.3071.86 (Desktop) and prior to 59.0.3071.92 (Android)

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

To upgrade Google Chrome to the latest secure version on Linux (Debian/Ubuntu-based systems), execute the following commands:

bash

# Update package lists and upgrade Google Chrome to the latest stable release
sudo apt-get update && sudo apt-get --only-upgrade install google-chrome-stable -y

# Verify the installed version
google-chrome --version

2. Temporary Workaround & Hardening Configuration

If immediate patching is not feasible, enforce Group Policy Objects (GPO) to restrict JavaScript execution on untrusted sites and ensure that the Chrome sandbox is never disabled:

bash

# Ensure Chrome processes are not running with the '--no-sandbox' flag
ps aux | grep chrome | grep 'no-sandbox'

3. Log Audit & IoC Verification Commands

Use the following PowerShell script to audit Windows endpoints and identify vulnerable installations of Google Chrome:

powershell

# PowerShell script to check Chrome version via Registry
$chromePath = 'HKLM:\Software\Microsoft\Windows\CurrentVersion\App Paths\chrome.exe'
if (Test-Path $chromePath) {
    $version = (Get-ItemProperty $chromePath).'(default)'
    $fileVersion = [System.Diagnostics.FileVersionInfo]::GetVersionInfo($version).FileVersion
    Write-Host 'Installed Chrome Version: ' $fileVersion
    # Alert if version is below 59.0.3071.86
    if ([System.Version]$fileVersion -lt [System.Version]'59.0.3071.86') {
        Write-Warning 'Vulnerable Chrome version detected! Update immediately.'
    } else {
        Write-Host 'Chrome is up-to-date.' -ForegroundColor Green
    }
}

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

SentinelOne Singularity AI EDR

Due to active exploitation in the wild, immediately update all Google Chrome installations to the latest stable version.

Block Kernel Privilege Escalation & Ransomware Payloads Before You Can Reboot

Protect unpatched Windows, Linux, and macOS workloads against in-memory exploitation and lateral movement with autonomous EDR.

100% MITRE ATT&CK Detection · 1-Click Rollback

See Autonomous Endpoint Protection in Action

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2017-5070) is a critical Type Confusion (CWE-843) flaw residing in the V8 JavaScript engine of Google Chrome. The root cause lies in the JIT (Just-In-Time) compiler's optimization pipeline, where a mismatch occurs between the assumed type of an object during compilation and its actual runtime type, leading to out-of-bounds memory access.

2. Exploitation Mechanics & Attack Scenario

An attacker can exploit this vulnerability by hosting a malicious HTML page containing crafted JavaScript code. When a target user visits the page, the V8 engine misinterprets the object layout during optimization. This allows the attacker to construct arbitrary read/write primitives in memory, leading to shellcode execution within the context of the Chrome renderer process.

3. Infrastructure & Business Impact

As a vulnerability listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, this flaw has been actively exploited in the wild. Although the execution is restricted within the renderer sandbox, successful exploitation can be chained with local privilege escalation (LPE) vulnerabilities to compromise the underlying operating system, posing a severe threat to enterprise endpoints.

Official Vendor Advisories & References

NVD Original English Description

Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

http://www.securityfocus.com/bid/98861

Source: chrome-cve-admin@google.com · Broken Link, Third Party Advisory, VDB Entry

http://www.securitytracker.com/id/1038622

Source: chrome-cve-admin@google.com · Broken Link, Third Party Advisory, VDB Entry

https://access.redhat.com/errata/RHSA-2017:1399

Source: chrome-cve-admin@google.com · Third Party Advisory

https://chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop.html

Source: chrome-cve-admin@google.com · Release Notes, Vendor Advisory

https://crbug.com/722756

Source: chrome-cve-admin@google.com · Exploit, Issue Tracking

https://security.gentoo.org/glsa/201706-20

Source: chrome-cve-admin@google.com · Third Party Advisory

Frequently Asked SecOps Questions (CVE-2017-5070)

FAQ

Q1. How critical is CVE-2017-5070 and is it actively exploited in the wild?

CVE-2017-5070 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 32.1%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2017-5070?

Primary impacted vendors include google across chrome, v8. Scope summary: Google Chrome prior to 59.0.3071.86 (Desktop) and prior to 59.0.3071.92 (Android)

Q3. What temporary mitigations or workarounds exist for CVE-2017-5070 before patching?

[Mitigation] Immediately update Google Chrome to the latest stable version (59.0.3071.86 or higher) and enforce automatic updates across the enterprise Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION