CVE-2018-17479
Incorrect object lifetime calculations in GPU code in Google Chrome prior to 70.0.3538.110...
8.8 HighFix available
Incorrect object lifetime calculations in GPU code in Google Chrome prior to 70.0.3538.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
0.88%Up 0.6 points since Apr 14, 2021
What each source reports
NVD Score used
Incorrect object lifetime calculations in GPU code in Google Chrome prior to 70.0.3538.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Record
CVE-2018-17479- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-416, CWE-787
- Updated
- 2026-11-02
CVE List No score
Incorrect object lifetime calculations in GPU code in Google Chrome prior to 70.0.3538.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Record
CVE-2018-17479- Updated
- 2026-11-02
EUVDEUVD-2018-9232 No score
Incorrect object lifetime calculations in GPU code in Google Chrome prior to 70.0.3538.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Record
EUVD-2018-9232- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x2q7-fcrc-98r2 No score
Incorrect object lifetime calculations in GPU code in Google Chrome prior to 70.0.3538.110...
Incorrect object lifetime calculations in GPU code in Google Chrome prior to 70.0.3538.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Record
GHSA-x2q7-fcrc-98r2- Updated
- 2026-11-02
OSVRHSA-2018:3648
Red Hat Security Advisory: chromium-browser security update
- Record
RHSA-2018:3648- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-17479
Incorrect object lifetime calculations in GPU code in Google Chrome prior to 70.0.3538.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- Record
UBUNTU-CVE-2018-17479- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10681-1 No score
chromedriver-93.0.4577.82-1.1 on GA media
These are all security issues fixed in the chromedriver-93.0.4577.82-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10681-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score
ungoogled-chromium-113.0.5672.92-1.1 on GA media
These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12948-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromium-browserDebian:9 |
before 70.0.3538.110-1~deb9u1, plus listed versions 59.0.3071.104-159.0.3071.86-160.0.3112.72-160.0.3112.78-160.0.3112.78-1~deb9u1 Show 45 moreShow less61.0.3163.100-161.0.3163.100-1~deb9u161.0.3163.100-262.0.3202.75-162.0.3202.75-1~deb9u162.0.3202.89-162.0.3202.89-1~deb9u163.0.3239.30-163.0.3239.40-163.0.3239.84-163.0.3239.84-1~deb9u164.0.3282.119-164.0.3282.119-1~deb9u164.0.3282.119-265.0.3325.146-165.0.3325.146-265.0.3325.146-365.0.3325.146-465.0.3325.73-165.0.3325.74-166.0.3359.117-166.0.3359.117-1~deb9u166.0.3359.139-166.0.3359.181-166.0.3359.22-166.0.3359.22-266.0.3359.22-366.0.3359.26-166.0.3359.26-267.0.3396.48-167.0.3396.56-167.0.3396.57-167.0.3396.62-167.0.3396.62-267.0.3396.79-167.0.3396.79-267.0.3396.87-167.0.3396.87-1~deb9u168.0.3440.17-168.0.3440.25-168.0.3440.33-168.0.3440.42-168.0.3440.7-168.0.3440.75-168.0.3440.75-1~deb9u1 |
70.0.3538.110-1~deb9u1 |
chromium-browserRed Hat:rhel_extras:6 From an advisory covering 2 CVEs |
before 0:70.0.3538.110-1.el6_10 | 0:70.0.3538.110-1.el6_10 |
chromium-browser-debuginfoRed Hat:rhel_extras:6 From an advisory covering 2 CVEs |
before 0:70.0.3538.110-1.el6_10 | 0:70.0.3538.110-1.el6_10 |
chromium-browserUbuntu:16.04:LTS |
before 70.0.3538.110-0ubuntu0.16.04.1, plus listed versions 45.0.2454.101-0ubuntu1.120147.0.2526.73-0ubuntu1.121847.0.2526.106-0ubuntu1.122148.0.2564.82-0ubuntu1.122248.0.2564.116-0ubuntu1.1229 Show 37 moreShow less49.0.2623.87-0ubuntu1.123249.0.2623.108-0ubuntu1.123350.0.2661.102-0ubuntu0.16.04.1.123751.0.2704.79-0ubuntu0.16.04.1.124252.0.2743.116-0ubuntu0.16.04.1.125053.0.2785.143-0ubuntu0.16.04.1.125453.0.2785.143-0ubuntu0.16.04.1.125755.0.2883.87-0ubuntu0.16.04.126356.0.2924.76-0ubuntu0.16.04.126857.0.2987.98-0ubuntu0.16.04.127658.0.3029.81-0ubuntu0.16.04.127758.0.3029.96-0ubuntu0.16.04.127958.0.3029.110-0ubuntu0.16.04.128159.0.3071.109-0ubuntu0.16.04.128959.0.3071.109-0ubuntu0.16.04.129160.0.3112.78-0ubuntu0.16.04.129360.0.3112.113-0ubuntu0.16.04.129861.0.3163.79-0ubuntu0.16.04.130061.0.3163.100-0ubuntu0.16.04.130662.0.3202.62-0ubuntu0.16.04.130862.0.3202.75-0ubuntu0.16.04.131362.0.3202.89-0ubuntu0.16.04.131562.0.3202.94-0ubuntu0.16.04.131763.0.3239.84-0ubuntu0.16.04.163.0.3239.132-0ubuntu0.16.04.164.0.3282.119-0ubuntu0.16.04.164.0.3282.140-0ubuntu0.16.04.164.0.3282.167-0ubuntu0.16.04.165.0.3325.181-0ubuntu0.16.04.166.0.3359.139-0ubuntu0.16.04.366.0.3359.181-0ubuntu0.16.04.167.0.3396.99-0ubuntu0.16.04.268.0.3440.75-0ubuntu0.16.04.168.0.3440.106-0ubuntu0.16.04.169.0.3497.81-0ubuntu0.16.04.170.0.3538.67-0ubuntu0.16.04.170.0.3538.77-0ubuntu0.16.04.1 |
70.0.3538.110-0ubuntu0.16.04.1 |
chromium-browserUbuntu:18.04:LTS |
before 70.0.3538.110-0ubuntu0.18.04.1, plus listed versions 61.0.3163.100-0ubuntu1.137862.0.3202.62-0ubuntu0.17.10.138062.0.3202.89-0ubuntu1.138662.0.3202.94-0ubuntu1.138863.0.3239.84-0ubuntu1 Show 14 moreShow less63.0.3239.108-0ubuntu164.0.3282.119-0ubuntu164.0.3282.140-0ubuntu164.0.3282.167-0ubuntu165.0.3325.146-0ubuntu165.0.3325.181-0ubuntu166.0.3359.139-0ubuntu0.18.04.366.0.3359.181-0ubuntu0.18.04.167.0.3396.99-0ubuntu0.18.04.168.0.3440.75-0ubuntu0.18.04.168.0.3440.106-0ubuntu0.18.04.169.0.3497.81-0ubuntu0.18.04.170.0.3538.67-0ubuntu0.18.04.170.0.3538.77-0ubuntu0.18.04.1 |
70.0.3538.110-0ubuntu0.18.04.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 1081 CVEs |
before 93.0.4577.82-1.1 | 93.0.4577.82-1.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 2310 CVEs |
before 113.0.5672.92-1.1 | 113.0.5672.92-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-17479 is a high vulnerability (CVSS 8.8) in Google Chrome, published November 21, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.88%, the 59th percentile. Fixed in chromium-browser 70.0.3538.110-1~deb9u1.
References
crbug.com/905336
chromereleases.googleblog.com/2018/11/stable-channel-update-for-chrome-os.html
nvd.nist.gov/vuln/detail/CVE-2018-17479
github.com/advisories/GHSA-x2q7-fcrc-98r2
access.redhat.com/errata/RHSA-2018:3648
Show 194 moreShow less
bugzilla.redhat.com/show_bug.cgi?id=1648855
security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_3648.json
cve.org/CVERecord?id=CVE-2018-17478
ubuntu.com/security/CVE-2018-17479
suse.com/security/cve/CVE-2017-11215
This page doesn't list everything
Left out here: 17 versions and 2,127 references. The JSON record has them.