CVE-2017-5116
Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0...
8.8 HighFix available
Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
12.7%Up 9.9 points since Apr 14, 2021
What each source reports
NVD Score used
Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- Record
CVE-2017-5116- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-843
- Updated
- 2026-11-02
CVE List No score
Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- Record
CVE-2017-5116- Updated
- 2026-11-02
EUVDEUVD-2017-14225 No score
Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- Record
EUVD-2017-14225- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-hvc8-7rpc-2g6w
Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0...
Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- Record
GHSA-hvc8-7rpc-2g6w- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-843
- Updated
- 2026-11-02
OSVRHSA-2017:2676
Red Hat Security Advisory: chromium-browser security update
- Record
RHSA-2017:2676- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-5116
Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- Record
UBUNTU-CVE-2017-5116- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVMGASA-2017-0423 No score
Updated chromium-browser-stable packages fix security issues
Chromium-browser 62.0.3202.94 fixes security issues: Multiple flaws were found in the way Chromium 60 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information. (CVE-2017-5111, CVE-2017-5112, CVE-2017-5113, CVE-2017-5114, CVE-2017-5115, CVE-2017-5116, CVE-2017-5117, CVE-2017-5118, CVE-2017-5119, CVE-2017-5120, CVE-2017-5121, CVE-2017-5122, CVE-2017-5124, CVE-2017-5125, CVE-2017-5126, CVE-2017-5127, CVE-2017-5128, CVE-2017-5129, CVE-2017-5130, CVE-2017-5131, CVE-2017-5132, CVE-2017-5133, CVE-2017-15386, CVE-2017-15387, CVE-2017-15388, CVE-2017-15389, CVE-2017-15390, CVE-2017-15391, CVE-2017-15392, CVE-2017-15393, CVE-2017-15394, CVE-2017-15395, CVE-2017-15396, CVE-2017-15398, CVE-2017-15399, CVE-2017-15406)
- Record
MGASA-2017-0423- Updated
- 2026-11-02
OSVopenSUSE-SU-2017:2482-1 No score
Security update for chromium
This update for chromium to version 61.0.3163.79 fixes several issues.
These security issues were fixed:
- CVE-2017-5111: Use after free in PDFium (boo#1057364).
- CVE-2017-5112: Heap buffer overflow in WebGL (boo#1057364).
- CVE-2017-5113: Heap buffer overflow in Skia (boo#1057364).
- CVE-2017-5114: Memory lifecycle issue in PDFium (boo#1057364).
- CVE-2017-5115: Type confusion in V8 (boo#1057364).
- CVE-2017-5116: Type confusion in V8 (boo#1057364).
- CVE-2017-5117: Use of uninitialized value in Skia (boo#1057364).
- CVE-2017-5118: Bypass of Content Security Policy in Blink (boo#1057364).
- CVE-2017-5119: Use of uninitialized value in Skia (boo#1057364).
- CVE-2017-5120: Potential HTTPS downgrade during redirect navigation (boo#1057364).
- Record
openSUSE-SU-2017:2482-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2017:2491-1 No score
Security update for chromium
This update for chromium to version 61.0.3163.79 fixes several issues.
These security issues were fixed:
- CVE-2017-5111: Use after free in PDFium (boo#1057364).
- CVE-2017-5112: Heap buffer overflow in WebGL (boo#1057364).
- CVE-2017-5113: Heap buffer overflow in Skia (boo#1057364).
- CVE-2017-5114: Memory lifecycle issue in PDFium (boo#1057364).
- CVE-2017-5115: Type confusion in V8 (boo#1057364).
- CVE-2017-5116: Type confusion in V8 (boo#1057364).
- CVE-2017-5117: Use of uninitialized value in Skia (boo#1057364).
- CVE-2017-5118: Bypass of Content Security Policy in Blink (boo#1057364).
- CVE-2017-5119: Use of uninitialized value in Skia (boo#1057364).
- CVE-2017-5120: Potential HTTPS downgrade during redirect navigation (boo#1057364).
- Record
openSUSE-SU-2017:2491-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10681-1 No score
chromedriver-93.0.4577.82-1.1 on GA media
These are all security issues fixed in the chromedriver-93.0.4577.82-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10681-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score
ungoogled-chromium-113.0.5672.92-1.1 on GA media
These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12948-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromium-browserDebian:9 |
before 61.0.3163.100-1~deb9u1, plus listed versions 59.0.3071.104-159.0.3071.86-160.0.3112.72-160.0.3112.78-160.0.3112.78-1~deb9u1 |
61.0.3163.100-1~deb9u1 |
chromium-browser-stableMageia:6 |
before 62.0.3202.94-1.mga6 | 62.0.3202.94-1.mga6 |
chromium-browserRed Hat:rhel_extras:6 |
before 0:61.0.3163.79-2.el6_9 | 0:61.0.3163.79-2.el6_9 |
chromium-browser-debuginfoRed Hat:rhel_extras:6 |
before 0:61.0.3163.79-2.el6_9 | 0:61.0.3163.79-2.el6_9 |
chromium-browserUbuntu:14.04:LTS |
before 61.0.3163.100-0ubuntu0.14.04.1202, plus listed versions 29.0.1547.65-0ubuntu231.0.1650.63-0ubuntu1~20131204.132.0.1700.107-0ubuntu1~20140204.977.133.0.1750.152-0ubuntu1~pkg995.134.0.1847.116-0ubuntu2 Show 32 moreShow less36.0.1985.125-0ubuntu1.14.04.0~pkg102937.0.2062.94-0ubuntu0.14.04.1~pkg104237.0.2062.120-0ubuntu0.14.04.1~pkg104938.0.2125.111-0ubuntu0.14.04.1.106139.0.2171.65-0ubuntu0.14.04.1.106440.0.2214.94-0ubuntu0.14.04.1.106840.0.2214.111-0ubuntu0.14.04.1.106941.0.2272.76-0ubuntu0.14.04.1.107643.0.2357.81-0ubuntu0.14.04.1.108943.0.2357.130-0ubuntu0.14.04.1.109244.0.2403.89-0ubuntu0.14.04.1.109545.0.2454.85-0ubuntu0.14.04.1.109745.0.2454.101-0ubuntu0.14.04.1.109947.0.2526.73-0ubuntu0.14.04.1.110647.0.2526.106-0ubuntu0.14.04.1.110748.0.2564.82-0ubuntu0.14.04.1.110848.0.2564.116-0ubuntu0.14.04.1.111149.0.2623.87-0ubuntu0.14.04.1.111249.0.2623.108-0ubuntu0.14.04.1.111350.0.2661.102-0ubuntu0.14.04.1.111751.0.2704.79-0ubuntu0.14.04.1.112152.0.2743.116-0ubuntu0.14.04.1.113453.0.2785.143-0ubuntu0.14.04.1.114253.0.2785.143-0ubuntu0.14.04.1.114558.0.3029.81-0ubuntu0.14.04.117258.0.3029.96-0ubuntu0.14.04.117458.0.3029.110-0ubuntu0.14.04.117659.0.3071.109-0ubuntu0.14.04.118659.0.3071.109-0ubuntu0.14.04.118860.0.3112.78-0ubuntu0.14.04.119060.0.3112.113-0ubuntu0.14.04.119461.0.3163.79-0ubuntu0.14.04.1196 |
61.0.3163.100-0ubuntu0.14.04.1202 |
chromium-browserUbuntu:16.04:LTS |
before 61.0.3163.100-0ubuntu0.16.04.1306, plus listed versions 45.0.2454.101-0ubuntu1.120147.0.2526.73-0ubuntu1.121847.0.2526.106-0ubuntu1.122148.0.2564.82-0ubuntu1.122248.0.2564.116-0ubuntu1.1229 Show 18 moreShow less49.0.2623.87-0ubuntu1.123249.0.2623.108-0ubuntu1.123350.0.2661.102-0ubuntu0.16.04.1.123751.0.2704.79-0ubuntu0.16.04.1.124252.0.2743.116-0ubuntu0.16.04.1.125053.0.2785.143-0ubuntu0.16.04.1.125453.0.2785.143-0ubuntu0.16.04.1.125755.0.2883.87-0ubuntu0.16.04.126356.0.2924.76-0ubuntu0.16.04.126857.0.2987.98-0ubuntu0.16.04.127658.0.3029.81-0ubuntu0.16.04.127758.0.3029.96-0ubuntu0.16.04.127958.0.3029.110-0ubuntu0.16.04.128159.0.3071.109-0ubuntu0.16.04.128959.0.3071.109-0ubuntu0.16.04.129160.0.3112.78-0ubuntu0.16.04.129360.0.3112.113-0ubuntu0.16.04.129861.0.3163.79-0ubuntu0.16.04.1300 |
61.0.3163.100-0ubuntu0.16.04.1306 |
oxide-qtUbuntu:16.04:LTS |
All versions, plus listed versions 1.9.5-0ubuntu11.10.3-0ubuntu0.15.10.11.10.3-0ubuntu0.15.10.21.11.3-0ubuntu31.11.4-0ubuntu1 Show 17 moreShow less1.11.5-0ubuntu11.12.5-0ubuntu11.12.6-0ubuntu11.12.7-0ubuntu11.13.6-0ubuntu11.14.7-0ubuntu11.14.9-0ubuntu0.16.04.11.15.7-0ubuntu0.16.04.11.15.8-0ubuntu0.16.04.11.16.5-0ubuntu0.16.04.11.17.7-0ubuntu0.16.04.11.17.9-0ubuntu0.16.04.11.18.3-0ubuntu0.16.04.11.18.5-0ubuntu0.16.04.11.19.4-0ubuntu0.16.04.11.20.4-0ubuntu0.16.04.11.21.5-0ubuntu0.16.04.1 |
None known |
libv8-3.14Ubuntu:16.04:LTS |
All versions, plus listed versions 3.14.5.8-5ubuntu2 |
None known |
chromium-browserUbuntu:18.04:LTS |
before 61.0.3163.100-0ubuntu1.1378 | 61.0.3163.100-0ubuntu1.1378 |
libv8-3.14Ubuntu:18.04:LTS |
All versions, plus listed versions 3.14.5.8-11ubuntu1 |
None known |
chromiumSUSE:Package Hub 12 SP2 |
before 61.0.3163.79-29.1 | 61.0.3163.79-29.1 |
chromiumopenSUSE:Tumbleweed |
before 93.0.4577.82-1.1 | 93.0.4577.82-1.1 |
chromiumopenSUSE:Tumbleweed |
before 113.0.5672.92-1.1 | 113.0.5672.92-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-5116 is a high vulnerability (CVSS 8.8) in Debian Linux, published September 15, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 12.7%, the 96th percentile. Fixed in chromium-browser 61.0.3163.100-1~deb9u1.
References
security.gentoo.org/glsa/201709-15
access.redhat.com/errata/RHSA-2017:2676
securitytracker.com/id/1039291
securityfocus.com/bid/100610
debian.org/security/2017/dsa-3985
security.googleblog.com/2018/01/android-security-ecosystem-investments.html
Show 194 moreShow less
chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop.html
crbug.com/759624
nvd.nist.gov/vuln/detail/CVE-2017-5116
github.com/advisories/GHSA-hvc8-7rpc-2g6w
advisories.mageia.org/MGASA-2017-0423.html
bugs.mageia.org/show_bug.cgi?id=21670
bugzilla.redhat.com/show_bug.cgi?id=1488772
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2676.json
cve.org/CVERecord?id=CVE-2017-5111
ubuntu.com/security/CVE-2017-5116
lists.opensuse.org/archives/list/[email protected]/thread/6LDRJVUTZ6JVIPU67FP76C2A2Z2QNPEA
bugzilla.suse.com/1057364
suse.com/security/cve/CVE-2017-5111
This page doesn't list everything
Left out here: 2,174 references. The JSON record has them.