CVE-2017-5121
Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux,...
Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to the escape analysis phase.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to the escape analysis phase.
- Record
CVE-2017-5121- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to the escape analysis phase.
- Record
CVE-2017-5121- Updated
- 2026-11-02
EUVDEUVD-2017-14230 No score
Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to the escape analysis phase.
- Record
EUVD-2017-14230- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8mmx-7cjv-h35q
Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux,...
Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to the escape analysis phase.
- Record
GHSA-8mmx-7cjv-h35q- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVRHSA-2017:2792
Red Hat Security Advisory: chromium-browser security update
- Record
RHSA-2017:2792- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-5121
Inappropriate use of JIT optimisation in V8 in Google Chrome prior to 61.0.3163.100 for Linux, Windows, and Mac allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to the escape analysis phase.
- Record
UBUNTU-CVE-2017-5121- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVMGASA-2017-0423 No score
Updated chromium-browser-stable packages fix security issues
Chromium-browser 62.0.3202.94 fixes security issues: Multiple flaws were found in the way Chromium 60 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information. (CVE-2017-5111, CVE-2017-5112, CVE-2017-5113, CVE-2017-5114, CVE-2017-5115, CVE-2017-5116, CVE-2017-5117, CVE-2017-5118, CVE-2017-5119, CVE-2017-5120, CVE-2017-5121, CVE-2017-5122, CVE-2017-5124, CVE-2017-5125, CVE-2017-5126, CVE-2017-5127, CVE-2017-5128, CVE-2017-5129, CVE-2017-5130, CVE-2017-5131, CVE-2017-5132, CVE-2017-5133, CVE-2017-15386, CVE-2017-15387, CVE-2017-15388, CVE-2017-15389, CVE-2017-15390, CVE-2017-15391, CVE-2017-15392, CVE-2017-15393, CVE-2017-15394, CVE-2017-15395, CVE-2017-15396, CVE-2017-15398, CVE-2017-15399, CVE-2017-15406)
- Record
MGASA-2017-0423- Updated
- 2026-11-02
OSVopenSUSE-SU-2017:2557-1 No score
Security update for Chromium
This update to Chromium 61.0.3163.100 fixes the following vulnerabilities:
- CVE-2017-5121: Out-of-bounds access in V8
- CVE-2017-5122: Out-of-bounds access in V8
- Various fixes from internal audits, fuzzing and other initiatives
- Record
openSUSE-SU-2017:2557-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2017:2558-1 No score
Security update for Chromium
This update to Chromium 61.0.3163.100 fixes the following vulnerabilities:
- CVE-2017-5121: Out-of-bounds access in V8
- CVE-2017-5122: Out-of-bounds access in V8
- Various fixes from internal audits, fuzzing and other initiatives
- Record
openSUSE-SU-2017:2558-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10681-1 No score
chromedriver-93.0.4577.82-1.1 on GA media
These are all security issues fixed in the chromedriver-93.0.4577.82-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10681-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score
ungoogled-chromium-113.0.5672.92-1.1 on GA media
These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12948-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromium-browserDebian:9 |
before 61.0.3163.100-1~deb9u1, plus listed versions 59.0.3071.104-159.0.3071.86-160.0.3112.72-160.0.3112.78-160.0.3112.78-1~deb9u1 |
61.0.3163.100-1~deb9u1 |
chromium-browser-stableMageia:6 |
before 62.0.3202.94-1.mga6 | 62.0.3202.94-1.mga6 |
chromium-browserRed Hat:rhel_extras:6 |
before 0:61.0.3163.100-1.el6_9 | 0:61.0.3163.100-1.el6_9 |
chromium-browser-debuginfoRed Hat:rhel_extras:6 |
before 0:61.0.3163.100-1.el6_9 | 0:61.0.3163.100-1.el6_9 |
chromium-browserUbuntu:14.04:LTS |
before 61.0.3163.100-0ubuntu0.14.04.1202, plus listed versions 29.0.1547.65-0ubuntu231.0.1650.63-0ubuntu1~20131204.132.0.1700.107-0ubuntu1~20140204.977.133.0.1750.152-0ubuntu1~pkg995.134.0.1847.116-0ubuntu2 Show 32 moreShow less36.0.1985.125-0ubuntu1.14.04.0~pkg102937.0.2062.94-0ubuntu0.14.04.1~pkg104237.0.2062.120-0ubuntu0.14.04.1~pkg104938.0.2125.111-0ubuntu0.14.04.1.106139.0.2171.65-0ubuntu0.14.04.1.106440.0.2214.94-0ubuntu0.14.04.1.106840.0.2214.111-0ubuntu0.14.04.1.106941.0.2272.76-0ubuntu0.14.04.1.107643.0.2357.81-0ubuntu0.14.04.1.108943.0.2357.130-0ubuntu0.14.04.1.109244.0.2403.89-0ubuntu0.14.04.1.109545.0.2454.85-0ubuntu0.14.04.1.109745.0.2454.101-0ubuntu0.14.04.1.109947.0.2526.73-0ubuntu0.14.04.1.110647.0.2526.106-0ubuntu0.14.04.1.110748.0.2564.82-0ubuntu0.14.04.1.110848.0.2564.116-0ubuntu0.14.04.1.111149.0.2623.87-0ubuntu0.14.04.1.111249.0.2623.108-0ubuntu0.14.04.1.111350.0.2661.102-0ubuntu0.14.04.1.111751.0.2704.79-0ubuntu0.14.04.1.112152.0.2743.116-0ubuntu0.14.04.1.113453.0.2785.143-0ubuntu0.14.04.1.114253.0.2785.143-0ubuntu0.14.04.1.114558.0.3029.81-0ubuntu0.14.04.117258.0.3029.96-0ubuntu0.14.04.117458.0.3029.110-0ubuntu0.14.04.117659.0.3071.109-0ubuntu0.14.04.118659.0.3071.109-0ubuntu0.14.04.118860.0.3112.78-0ubuntu0.14.04.119060.0.3112.113-0ubuntu0.14.04.119461.0.3163.79-0ubuntu0.14.04.1196 |
61.0.3163.100-0ubuntu0.14.04.1202 |
chromium-browserUbuntu:16.04:LTS |
before 61.0.3163.100-0ubuntu0.16.04.1306, plus listed versions 45.0.2454.101-0ubuntu1.120147.0.2526.73-0ubuntu1.121847.0.2526.106-0ubuntu1.122148.0.2564.82-0ubuntu1.122248.0.2564.116-0ubuntu1.1229 Show 18 moreShow less49.0.2623.87-0ubuntu1.123249.0.2623.108-0ubuntu1.123350.0.2661.102-0ubuntu0.16.04.1.123751.0.2704.79-0ubuntu0.16.04.1.124252.0.2743.116-0ubuntu0.16.04.1.125053.0.2785.143-0ubuntu0.16.04.1.125453.0.2785.143-0ubuntu0.16.04.1.125755.0.2883.87-0ubuntu0.16.04.126356.0.2924.76-0ubuntu0.16.04.126857.0.2987.98-0ubuntu0.16.04.127658.0.3029.81-0ubuntu0.16.04.127758.0.3029.96-0ubuntu0.16.04.127958.0.3029.110-0ubuntu0.16.04.128159.0.3071.109-0ubuntu0.16.04.128959.0.3071.109-0ubuntu0.16.04.129160.0.3112.78-0ubuntu0.16.04.129360.0.3112.113-0ubuntu0.16.04.129861.0.3163.79-0ubuntu0.16.04.1300 |
61.0.3163.100-0ubuntu0.16.04.1306 |
oxide-qtUbuntu:16.04:LTS |
All versions, plus listed versions 1.9.5-0ubuntu11.10.3-0ubuntu0.15.10.11.10.3-0ubuntu0.15.10.21.11.3-0ubuntu31.11.4-0ubuntu1 Show 17 moreShow less1.11.5-0ubuntu11.12.5-0ubuntu11.12.6-0ubuntu11.12.7-0ubuntu11.13.6-0ubuntu11.14.7-0ubuntu11.14.9-0ubuntu0.16.04.11.15.7-0ubuntu0.16.04.11.15.8-0ubuntu0.16.04.11.16.5-0ubuntu0.16.04.11.17.7-0ubuntu0.16.04.11.17.9-0ubuntu0.16.04.11.18.3-0ubuntu0.16.04.11.18.5-0ubuntu0.16.04.11.19.4-0ubuntu0.16.04.11.20.4-0ubuntu0.16.04.11.21.5-0ubuntu0.16.04.1 |
None known |
libv8-3.14Ubuntu:16.04:LTS |
All versions, plus listed versions 3.14.5.8-5ubuntu2 |
None known |
chromium-browserUbuntu:18.04:LTS |
before 61.0.3163.100-0ubuntu1.1378 | 61.0.3163.100-0ubuntu1.1378 |
libv8-3.14Ubuntu:18.04:LTS |
All versions, plus listed versions 3.14.5.8-11ubuntu1 |
None known |
chromiumSUSE:Package Hub 12 SP2 |
before 61.0.3163.100-32.1 | 61.0.3163.100-32.1 |
chromiumopenSUSE:Tumbleweed |
before 93.0.4577.82-1.1 | 93.0.4577.82-1.1 |
chromiumopenSUSE:Tumbleweed |
before 113.0.5672.92-1.1 | 113.0.5672.92-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-5121 is a high vulnerability (CVSS 8.8) in Debian Linux, published September 23, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 5.29%, the 92nd percentile. Fixed in chromium-browser 61.0.3163.100-1~deb9u1.
References
securityfocus.com/bid/100947
security.gentoo.org/glsa/201709-25
chromereleases.googleblog.com/2017/09/stable-channel-update-for-desktop_21.html
blogs.technet.microsoft.com/mmpc/2017/10/18/browser-security-beyond-sandboxing
access.redhat.com/errata/RHSA-2017:2792
securitytracker.com/id/1039497
Show 194 moreShow less
crbug.com/765433
debian.org/security/2017/dsa-3985
nvd.nist.gov/vuln/detail/CVE-2017-5121
github.com/advisories/GHSA-8mmx-7cjv-h35q
advisories.mageia.org/MGASA-2017-0423.html
bugs.mageia.org/show_bug.cgi?id=21670
bugzilla.redhat.com/show_bug.cgi?id=1494391
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2792.json
cve.org/CVERecord?id=CVE-2017-5121
ubuntu.com/security/CVE-2017-5121
bugzilla.suse.com/1060019
suse.com/security/cve/CVE-2017-5121
Left out here: 2,140 references. The JSON record has them.