CVE-2018-6065

Integer overflow in computing the required allocation size when instantiating a new javascript...

8.8 HighIn KEVPublic exploitFix available

Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

60.3%Up 56.5 points since Apr 14, 2021

What each source reports

NVD Score used 8.8

Record: CVE-2018-6065
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-190
Updated: 2026-11-02

CVE List 8.8

Record: CVE-2018-6065
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-190
Updated: 2026-11-02

EUVDEUVD-2018-17828 8.8

Record: EUVD-2018-17828
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-cw7c-4r65-xf9h 8.8

Integer overflow in computing the required allocation size when instantiating a new javascript...

Record: GHSA-cw7c-4r65-xf9h
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-190, CWE-787
Updated: 2026-11-02

CISA KEV No score

Google Chromium V8 Integer Overflow Vulnerability

Google Chromium V8 Engine contains an integer overflow vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Record: CVE-2018-6065
Weakness: CWE-190, CWE-787
Updated: 2026-11-02

OSVRHSA-2018:0484 8.8

Red Hat Security Advisory: chromium-browser security update

Record: RHSA-2018:0484
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 6 moreShow less

OSVUBUNTU-CVE-2018-6065 8.8

Record: UBUNTU-CVE-2018-6065
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0: 8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2018-0268 No score

Updated chromium-browser-stable packages fix security vulnerabilities

Chromium-browser 67.0.3396.62 fixes security issues:

Multiple flaws were found in the way Chromium 64.0.3282.140 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information. (CVE-2017-11215, CVE-2017-11225, CVE-2018-6056, CVE-2018-6057, CVE-2018-6060, CVE-2018-6061, CVE-2018-6062, CVE-2018-6063, CVE-2018-6064, CVE-2018-6065, CVE-2018-6066, CVE-2018-6067, CVE-2018-6068, CVE-2018-6069, CVE-2018-6070, CVE-2018-6071, CVE-2018-6072, CVE-2018-6073, CVE-2018-6074, CVE-2018-6075, CVE-2018-6076, CVE-2018-6077, CVE-2018-6078, CVE-2018-6079, CVE-2018-6080, CVE-2018-6081, CVE-2018-6082, CVE-2018-6083, CVE-2018-6084, CVE-2018-6085, CVE-2018-6086, CVE-2018-6087, CVE-2018-6088, CVE-2018-6089, CVE-2018-6090, CVE-2018-6091, CVE-2018-6092, CVE-2018-6093, CVE-2018-6094, CVE-2018-6095, CVE-2018-6096, CVE-2018-6097, CVE-2018-6098, CVE-2018-6099, CVE-2018-6100, CVE-2018-6101, CVE-2018-6102, CVE-2018-6103, CVE-2018-6104, CVE-2018-6105, CVE-2018-6106, CVE-2018-6107, CVE-2018-6108, CVE-2018-6109, CVE-2018-6110, CVE-2018-6111, CVE-2018-6112, CVE-2018-6113, CVE-2018-6114, CVE-2018-6115, CVE-2018-6116, CVE-2018-6117, CVE-2018-6118, CVE-2018-6120, CVE-2018-6121, CVE-2018-6122, CVE-2018-6123, CVE-2018-6124, CVE-2018-6126, CVE-2018-6127, CVE-2018-6128, CVE-2018-6129, CVE-2018-6130, CVE-2018-6131, CVE-2018-6132, CVE-2018-6133, CVE-2018-6134, CVE-2018-6135, CVE-2018-6136, CVE-2018-6137, CVE-2018-6138, CVE-2018-6139, CVE-2018-6140, CVE-2018-6141, CVE-2018-6142, CVE-2018-6143, CVE-2018-6144, CVE-2018-6145, CVE-2018-6147)

Record: MGASA-2018-0268
Updated: 2026-11-02

OSVopenSUSE-SU-2018:1175-1 No score

Security update for Chromium

This update for Chromium to version 66.0.3359.181 fixes the following issues:

CVE-2018-6118: Use after free in Media Cache (bsc#1091288)
CVE-2018-6085: Use after free in Disk Cache
CVE-2018-6086: Use after free in Disk Cache
CVE-2018-6087: Use after free in WebAssembly
CVE-2018-6088: Use after free in PDFium
CVE-2018-6089: Same origin policy bypass in Service Worker
CVE-2018-6090: Heap buffer overflow in Skia
CVE-2018-6091: Incorrect handling of plug-ins by Service Worker
CVE-2018-6092: Integer overflow in WebAssembly
CVE-2018-6093: Same origin bypass in Service Worker
CVE-2018-6094: Exploit hardening regression in Oilpan
CVE-2018-6095: Lack of meaningful user interaction requirement before file upload
CVE-2018-6096: Fullscreen UI spoof
CVE-2018-6097: Fullscreen UI spoof
CVE-2018-6098: URL spoof in Omnibox
CVE-2018-6099: CORS bypass in ServiceWorker
CVE-2018-6100: URL spoof in Omnibox
CVE-2018-6101: Insufficient protection of remote debugging prototol in DevTools
CVE-2018-6102: URL spoof in Omnibox
CVE-2018-6103: UI spoof in Permissions
CVE-2018-6104: URL spoof in Omnibox
CVE-2018-6105: URL spoof in Omnibox
CVE-2018-6106: Incorrect handling of promises in V8
CVE-2018-6107: URL spoof in Omnibox
CVE-2018-6108: URL spoof in Omnibox
CVE-2018-6109: Incorrect handling of files by FileAPI
CVE-2018-6110: Incorrect handling of plaintext files via file://
CVE-2018-6111: Heap-use-after-free in DevTools
CVE-2018-6112: Incorrect URL handling in DevTools
CVE-2018-6113: URL spoof in Navigation
CVE-2018-6114: CSP bypass
CVE-2018-6115: SmartScreen bypass in downloads
CVE-2018-6116: Incorrect low memory handling in WebAssembly
CVE-2018-6117: Confusing autofill settings
CVE-2017-11215: Use after free in Flash
CVE-2017-11225: Use after free in Flash
CVE-2018-6060: Use after free in Blink
CVE-2018-6061: Race condition in V8
CVE-2018-6062: Heap buffer overflow in Skia
CVE-2018-6057: Incorrect permissions on shared memory
CVE-2018-6063: Incorrect permissions on shared memory
CVE-2018-6064: Type confusion in V8
CVE-2018-6065: Integer overflow in V8
CVE-2018-6066: Same Origin Bypass via canvas
CVE-2018-6067: Buffer overflow in Skia
CVE-2018-6068: Object lifecycle issues in Chrome Custom Tab
CVE-2018-6069: Stack buffer overflow in Skia
CVE-2018-6070: CSP bypass through extensions
CVE-2018-6071: Heap bufffer overflow in Skia
CVE-2018-6072: Integer overflow in PDFium
CVE-2018-6073: Heap bufffer overflow in WebGL
CVE-2018-6074: Mark-of-the-Web bypass
CVE-2018-6075: Overly permissive cross origin downloads
CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink
CVE-2018-6077: Timing attack using SVG filters
CVE-2018-6078: URL Spoof in OmniBox
CVE-2018-6079: Information disclosure via texture data in WebGL
CVE-2018-6080: Information disclosure in IPC call
CVE-2018-6081: XSS in interstitials
CVE-2018-6082: Circumvention of port blocking
CVE-2018-6083: Incorrect processing of AppManifests
CVE-2018-6121: Privilege Escalation in extensions
CVE-2018-6122: Type confusion in V8
CVE-2018-6120: Heap buffer overflow in PDFium
bsc#1086124: Various fixes from internal audits, fuzzing and other initiatives

This update also supports mitigation against the Spectre vulnerabilities:

'Strict site isolation' is disabled for most users and can be turned on via: chrome://flags/#enable-site-per-process

This feature is undergoing a small percentage trial. Out out of the trial is possible via: chrome://flags/#site-isolation-trial-opt-out

The following tracked packaging bug were fixed:

Chromium could not be installed from SUSE PackageHub 12 without having the SDK enabled (bsc#1070421)
Chromium could not be installed when libminizip1 was not available (bsc#1093031)

Record: openSUSE-SU-2018:1175-1
Updated: 2026-11-02

OSVopenSUSE-SU-2018:1437-1 No score

Security update for Chromium

This update for Chromium to version 66.0.3359.181 fixes the following issues:

CVE-2018-6118: Use after free in Media Cache (bsc#1091288)
CVE-2018-6085: Use after free in Disk Cache
CVE-2018-6086: Use after free in Disk Cache
CVE-2018-6087: Use after free in WebAssembly
CVE-2018-6088: Use after free in PDFium
CVE-2018-6089: Same origin policy bypass in Service Worker
CVE-2018-6090: Heap buffer overflow in Skia
CVE-2018-6091: Incorrect handling of plug-ins by Service Worker
CVE-2018-6092: Integer overflow in WebAssembly
CVE-2018-6093: Same origin bypass in Service Worker
CVE-2018-6094: Exploit hardening regression in Oilpan
CVE-2018-6095: Lack of meaningful user interaction requirement before file upload
CVE-2018-6096: Fullscreen UI spoof
CVE-2018-6097: Fullscreen UI spoof
CVE-2018-6098: URL spoof in Omnibox
CVE-2018-6099: CORS bypass in ServiceWorker
CVE-2018-6100: URL spoof in Omnibox
CVE-2018-6101: Insufficient protection of remote debugging prototol in DevTools
CVE-2018-6102: URL spoof in Omnibox
CVE-2018-6103: UI spoof in Permissions
CVE-2018-6104: URL spoof in Omnibox
CVE-2018-6105: URL spoof in Omnibox
CVE-2018-6106: Incorrect handling of promises in V8
CVE-2018-6107: URL spoof in Omnibox
CVE-2018-6108: URL spoof in Omnibox
CVE-2018-6109: Incorrect handling of files by FileAPI
CVE-2018-6110: Incorrect handling of plaintext files via file://
CVE-2018-6111: Heap-use-after-free in DevTools
CVE-2018-6112: Incorrect URL handling in DevTools
CVE-2018-6113: URL spoof in Navigation
CVE-2018-6114: CSP bypass
CVE-2018-6115: SmartScreen bypass in downloads
CVE-2018-6116: Incorrect low memory handling in WebAssembly
CVE-2018-6117: Confusing autofill settings
CVE-2017-11215: Use after free in Flash
CVE-2017-11225: Use after free in Flash
CVE-2018-6060: Use after free in Blink
CVE-2018-6061: Race condition in V8
CVE-2018-6062: Heap buffer overflow in Skia
CVE-2018-6057: Incorrect permissions on shared memory
CVE-2018-6063: Incorrect permissions on shared memory
CVE-2018-6064: Type confusion in V8
CVE-2018-6065: Integer overflow in V8
CVE-2018-6066: Same Origin Bypass via canvas
CVE-2018-6067: Buffer overflow in Skia
CVE-2018-6068: Object lifecycle issues in Chrome Custom Tab
CVE-2018-6069: Stack buffer overflow in Skia
CVE-2018-6070: CSP bypass through extensions
CVE-2018-6071: Heap bufffer overflow in Skia
CVE-2018-6072: Integer overflow in PDFium
CVE-2018-6073: Heap bufffer overflow in WebGL
CVE-2018-6074: Mark-of-the-Web bypass
CVE-2018-6075: Overly permissive cross origin downloads
CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink
CVE-2018-6077: Timing attack using SVG filters
CVE-2018-6078: URL Spoof in OmniBox
CVE-2018-6079: Information disclosure via texture data in WebGL
CVE-2018-6080: Information disclosure in IPC call
CVE-2018-6081: XSS in interstitials
CVE-2018-6082: Circumvention of port blocking
CVE-2018-6083: Incorrect processing of AppManifests
CVE-2018-6121: Privilege Escalation in extensions
CVE-2018-6122: Type confusion in V8
CVE-2018-6120: Heap buffer overflow in PDFium
bsc#1086124: Various fixes from internal audits, fuzzing and other initiatives

This update also supports mitigation against the Spectre vulnerabilities:

'Strict site isolation' is disabled for most users and can be turned on via: chrome://flags/#enable-site-per-process

This feature is undergoing a small percentage trial. Out out of the trial is possible via: chrome://flags/#site-isolation-trial-opt-out

The following tracked packaging bug were fixed:

Chromium could not be installed from SUSE PackageHub 12 without having the SDK enabled (bsc#1070421)
Chromium could not be installed when libminizip1 was not available (bsc#1093031)

Record: openSUSE-SU-2018:1437-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10681-1 No score

chromedriver-93.0.4577.82-1.1 on GA media

These are all security issues fixed in the chromedriver-93.0.4577.82-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10681-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:12948-1 No score

ungoogled-chromium-113.0.5672.92-1.1 on GA media

These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:12948-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`chromium-browser` Debian:9 From an advisory covering 58 CVEs	before 66.0.3359.117-1~deb9u1, plus listed versions 59.0.3071.104-159.0.3071.86-160.0.3112.72-160.0.3112.78-160.0.3112.78-1~deb9u1 Show 25 moreShow less 61.0.3163.100-161.0.3163.100-1~deb9u161.0.3163.100-262.0.3202.75-162.0.3202.75-1~deb9u162.0.3202.89-162.0.3202.89-1~deb9u163.0.3239.30-163.0.3239.40-163.0.3239.84-163.0.3239.84-1~deb9u164.0.3282.119-164.0.3282.119-1~deb9u164.0.3282.119-265.0.3325.146-165.0.3325.146-265.0.3325.146-365.0.3325.146-465.0.3325.73-165.0.3325.74-166.0.3359.22-166.0.3359.22-266.0.3359.22-366.0.3359.26-166.0.3359.26-2	66.0.3359.117-1~deb9u1
`chromium-browser-stable` Mageia:6 From an advisory covering 89 CVEs	before 67.0.3396.62-1.mga6	67.0.3396.62-1.mga6
`chromium-browser` Red Hat:rhel_extras:6 From an advisory covering 24 CVEs	before 0:65.0.3325.146-2.el6_9	0:65.0.3325.146-2.el6_9
`chromium-browser-debuginfo` Red Hat:rhel_extras:6 From an advisory covering 24 CVEs	before 0:65.0.3325.146-2.el6_9	0:65.0.3325.146-2.el6_9
`chromium-browser` Ubuntu:14.04:LTS	before 65.0.3325.181-0ubuntu0.14.04.1, plus listed versions 29.0.1547.65-0ubuntu231.0.1650.63-0ubuntu1~20131204.132.0.1700.107-0ubuntu1~20140204.977.133.0.1750.152-0ubuntu1~pkg995.134.0.1847.116-0ubuntu2 Show 42 moreShow less 36.0.1985.125-0ubuntu1.14.04.0~pkg102937.0.2062.94-0ubuntu0.14.04.1~pkg104237.0.2062.120-0ubuntu0.14.04.1~pkg104938.0.2125.111-0ubuntu0.14.04.1.106139.0.2171.65-0ubuntu0.14.04.1.106440.0.2214.94-0ubuntu0.14.04.1.106840.0.2214.111-0ubuntu0.14.04.1.106941.0.2272.76-0ubuntu0.14.04.1.107643.0.2357.81-0ubuntu0.14.04.1.108943.0.2357.130-0ubuntu0.14.04.1.109244.0.2403.89-0ubuntu0.14.04.1.109545.0.2454.85-0ubuntu0.14.04.1.109745.0.2454.101-0ubuntu0.14.04.1.109947.0.2526.73-0ubuntu0.14.04.1.110647.0.2526.106-0ubuntu0.14.04.1.110748.0.2564.82-0ubuntu0.14.04.1.110848.0.2564.116-0ubuntu0.14.04.1.111149.0.2623.87-0ubuntu0.14.04.1.111249.0.2623.108-0ubuntu0.14.04.1.111350.0.2661.102-0ubuntu0.14.04.1.111751.0.2704.79-0ubuntu0.14.04.1.112152.0.2743.116-0ubuntu0.14.04.1.113453.0.2785.143-0ubuntu0.14.04.1.114253.0.2785.143-0ubuntu0.14.04.1.114558.0.3029.81-0ubuntu0.14.04.117258.0.3029.96-0ubuntu0.14.04.117458.0.3029.110-0ubuntu0.14.04.117659.0.3071.109-0ubuntu0.14.04.118659.0.3071.109-0ubuntu0.14.04.118860.0.3112.78-0ubuntu0.14.04.119060.0.3112.113-0ubuntu0.14.04.119461.0.3163.79-0ubuntu0.14.04.119661.0.3163.100-0ubuntu0.14.04.120262.0.3202.62-0ubuntu0.14.04.120462.0.3202.75-0ubuntu0.14.04.121162.0.3202.89-0ubuntu0.14.04.121362.0.3202.94-0ubuntu0.14.04.121563.0.3239.84-0ubuntu0.14.04.163.0.3239.132-0ubuntu0.14.04.164.0.3282.119-0ubuntu0.14.04.164.0.3282.140-0ubuntu0.14.04.164.0.3282.167-0ubuntu0.14.04.1	65.0.3325.181-0ubuntu0.14.04.1
`chromium-browser` Ubuntu:16.04:LTS	before 65.0.3325.181-0ubuntu0.16.04.1, plus listed versions 45.0.2454.101-0ubuntu1.120147.0.2526.73-0ubuntu1.121847.0.2526.106-0ubuntu1.122148.0.2564.82-0ubuntu1.122248.0.2564.116-0ubuntu1.1229 Show 28 moreShow less 49.0.2623.87-0ubuntu1.123249.0.2623.108-0ubuntu1.123350.0.2661.102-0ubuntu0.16.04.1.123751.0.2704.79-0ubuntu0.16.04.1.124252.0.2743.116-0ubuntu0.16.04.1.125053.0.2785.143-0ubuntu0.16.04.1.125453.0.2785.143-0ubuntu0.16.04.1.125755.0.2883.87-0ubuntu0.16.04.126356.0.2924.76-0ubuntu0.16.04.126857.0.2987.98-0ubuntu0.16.04.127658.0.3029.81-0ubuntu0.16.04.127758.0.3029.96-0ubuntu0.16.04.127958.0.3029.110-0ubuntu0.16.04.128159.0.3071.109-0ubuntu0.16.04.128959.0.3071.109-0ubuntu0.16.04.129160.0.3112.78-0ubuntu0.16.04.129360.0.3112.113-0ubuntu0.16.04.129861.0.3163.79-0ubuntu0.16.04.130061.0.3163.100-0ubuntu0.16.04.130662.0.3202.62-0ubuntu0.16.04.130862.0.3202.75-0ubuntu0.16.04.131362.0.3202.89-0ubuntu0.16.04.131562.0.3202.94-0ubuntu0.16.04.131763.0.3239.84-0ubuntu0.16.04.163.0.3239.132-0ubuntu0.16.04.164.0.3282.119-0ubuntu0.16.04.164.0.3282.140-0ubuntu0.16.04.164.0.3282.167-0ubuntu0.16.04.1	65.0.3325.181-0ubuntu0.16.04.1
`oxide-qt` Ubuntu:16.04:LTS	All versions, plus listed versions 1.9.5-0ubuntu11.10.3-0ubuntu0.15.10.11.10.3-0ubuntu0.15.10.21.11.3-0ubuntu31.11.4-0ubuntu1 Show 17 moreShow less 1.11.5-0ubuntu11.12.5-0ubuntu11.12.6-0ubuntu11.12.7-0ubuntu11.13.6-0ubuntu11.14.7-0ubuntu11.14.9-0ubuntu0.16.04.11.15.7-0ubuntu0.16.04.11.15.8-0ubuntu0.16.04.11.16.5-0ubuntu0.16.04.11.17.7-0ubuntu0.16.04.11.17.9-0ubuntu0.16.04.11.18.3-0ubuntu0.16.04.11.18.5-0ubuntu0.16.04.11.19.4-0ubuntu0.16.04.11.20.4-0ubuntu0.16.04.11.21.5-0ubuntu0.16.04.1	None known
`libv8-3.14` Ubuntu:16.04:LTS	All versions, plus listed versions 3.14.5.8-5ubuntu2	None known
`libv8-3.14` Ubuntu:18.04:LTS	All versions, plus listed versions 3.14.5.8-11ubuntu1	None known
`chromium` SUSE:Package Hub 12 SP2 From an advisory covering 64 CVEs	before 66.0.3359.181-55.1	66.0.3359.181-55.1
`chromium` openSUSE:Tumbleweed From an advisory covering 1081 CVEs	before 93.0.4577.82-1.1	93.0.4577.82-1.1
`chromium` openSUSE:Tumbleweed From an advisory covering 2310 CVEs	before 113.0.5672.92-1.1	113.0.5672.92-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Google Chrome V8 - Object Allocation Size Integer Overflow	2018-05-04
PoC in GitHub	b1tg/CVE-2018-6065-exploit	2021-04-24

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected
Nov 3, 2026	exploitation
Nov 2, 2026	first indexed	CVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-6065 is a high vulnerability (CVSS 8.8) in Google Chrome, published April 28, 2018. CISA lists it as known to be exploited, since June 8, 2022. EUVD reports exploitation since June 8, 2022. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 60.3%, the 99th percentile. Fixed in chromium-browser 65.0.3325.181-0ubuntu0.14.04.1.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 2,239 references. The JSON record has them.