Every CVE Search/ Get API key

CVE-2018-6118

A double-eviction in the Incognito mode cache that lead to a user-after-free in cache in Google...

8.8 HighFix available

A double-eviction in the Incognito mode cache that lead to a user-after-free in cache in Google Chrome prior to 66.0.3359.139 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.91%Up 1.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 8.8

A double-eviction in the Incognito mode cache that lead to a user-after-free in cache in Google Chrome prior to 66.0.3359.139 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.

Record
CVE-2018-6118
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-416
Updated
2026-11-02
CVE List No score

A double-eviction in the Incognito mode cache that lead to a user-after-free in cache in Google Chrome prior to 66.0.3359.139 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.

Record
CVE-2018-6118
Updated
2026-11-02
EUVDEUVD-2018-17881 No score

A double-eviction in the Incognito mode cache that lead to a user-after-free in cache in Google Chrome prior to 66.0.3359.139 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.

Record
EUVD-2018-17881
Updated
2026-11-03
GitHub AdvisoriesGHSA-g93q-r5hj-4m44 8.8

A double-eviction in the Incognito mode cache that lead to a user-after-free in cache in Google...

A double-eviction in the Incognito mode cache that lead to a user-after-free in cache in Google Chrome prior to 66.0.3359.139 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.

Record
GHSA-g93q-r5hj-4m44
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-416
Updated
2026-11-02
OSVRHSA-2018:1321 9.6

Red Hat Security Advisory: chromium-browser security update

Record
RHSA-2018:1321
CVSS 3.0
9.6 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2018-6118 8.8

A double-eviction in the Incognito mode cache that lead to a user-after-free in cache in Google Chrome prior to 66.0.3359.139 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.

Record
UBUNTU-CVE-2018-6118
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVMGASA-2018-0268 No score

Updated chromium-browser-stable packages fix security vulnerabilities

Chromium-browser 67.0.3396.62 fixes security issues:

Multiple flaws were found in the way Chromium 64.0.3282.140 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information. (CVE-2017-11215, CVE-2017-11225, CVE-2018-6056, CVE-2018-6057, CVE-2018-6060, CVE-2018-6061, CVE-2018-6062, CVE-2018-6063, CVE-2018-6064, CVE-2018-6065, CVE-2018-6066, CVE-2018-6067, CVE-2018-6068, CVE-2018-6069, CVE-2018-6070, CVE-2018-6071, CVE-2018-6072, CVE-2018-6073, CVE-2018-6074, CVE-2018-6075, CVE-2018-6076, CVE-2018-6077, CVE-2018-6078, CVE-2018-6079, CVE-2018-6080, CVE-2018-6081, CVE-2018-6082, CVE-2018-6083, CVE-2018-6084, CVE-2018-6085, CVE-2018-6086, CVE-2018-6087, CVE-2018-6088, CVE-2018-6089, CVE-2018-6090, CVE-2018-6091, CVE-2018-6092, CVE-2018-6093, CVE-2018-6094, CVE-2018-6095, CVE-2018-6096, CVE-2018-6097, CVE-2018-6098, CVE-2018-6099, CVE-2018-6100, CVE-2018-6101, CVE-2018-6102, CVE-2018-6103, CVE-2018-6104, CVE-2018-6105, CVE-2018-6106, CVE-2018-6107, CVE-2018-6108, CVE-2018-6109, CVE-2018-6110, CVE-2018-6111, CVE-2018-6112, CVE-2018-6113, CVE-2018-6114, CVE-2018-6115, CVE-2018-6116, CVE-2018-6117, CVE-2018-6118, CVE-2018-6120, CVE-2018-6121, CVE-2018-6122, CVE-2018-6123, CVE-2018-6124, CVE-2018-6126, CVE-2018-6127, CVE-2018-6128, CVE-2018-6129, CVE-2018-6130, CVE-2018-6131, CVE-2018-6132, CVE-2018-6133, CVE-2018-6134, CVE-2018-6135, CVE-2018-6136, CVE-2018-6137, CVE-2018-6138, CVE-2018-6139, CVE-2018-6140, CVE-2018-6141, CVE-2018-6142, CVE-2018-6143, CVE-2018-6144, CVE-2018-6145, CVE-2018-6147)

Record
MGASA-2018-0268
Updated
2026-11-02
OSVopenSUSE-SU-2018:1175-1 No score

Security update for Chromium

This update for Chromium to version 66.0.3359.181 fixes the following issues:

  • CVE-2018-6118: Use after free in Media Cache (bsc#1091288)
  • CVE-2018-6085: Use after free in Disk Cache
  • CVE-2018-6086: Use after free in Disk Cache
  • CVE-2018-6087: Use after free in WebAssembly
  • CVE-2018-6088: Use after free in PDFium
  • CVE-2018-6089: Same origin policy bypass in Service Worker
  • CVE-2018-6090: Heap buffer overflow in Skia
  • CVE-2018-6091: Incorrect handling of plug-ins by Service Worker
  • CVE-2018-6092: Integer overflow in WebAssembly
  • CVE-2018-6093: Same origin bypass in Service Worker
  • CVE-2018-6094: Exploit hardening regression in Oilpan
  • CVE-2018-6095: Lack of meaningful user interaction requirement before file upload
  • CVE-2018-6096: Fullscreen UI spoof
  • CVE-2018-6097: Fullscreen UI spoof
  • CVE-2018-6098: URL spoof in Omnibox
  • CVE-2018-6099: CORS bypass in ServiceWorker
  • CVE-2018-6100: URL spoof in Omnibox
  • CVE-2018-6101: Insufficient protection of remote debugging prototol in DevTools
  • CVE-2018-6102: URL spoof in Omnibox
  • CVE-2018-6103: UI spoof in Permissions
  • CVE-2018-6104: URL spoof in Omnibox
  • CVE-2018-6105: URL spoof in Omnibox
  • CVE-2018-6106: Incorrect handling of promises in V8
  • CVE-2018-6107: URL spoof in Omnibox
  • CVE-2018-6108: URL spoof in Omnibox
  • CVE-2018-6109: Incorrect handling of files by FileAPI
  • CVE-2018-6110: Incorrect handling of plaintext files via file://
  • CVE-2018-6111: Heap-use-after-free in DevTools
  • CVE-2018-6112: Incorrect URL handling in DevTools
  • CVE-2018-6113: URL spoof in Navigation
  • CVE-2018-6114: CSP bypass
  • CVE-2018-6115: SmartScreen bypass in downloads
  • CVE-2018-6116: Incorrect low memory handling in WebAssembly
  • CVE-2018-6117: Confusing autofill settings
  • CVE-2017-11215: Use after free in Flash
  • CVE-2017-11225: Use after free in Flash
  • CVE-2018-6060: Use after free in Blink
  • CVE-2018-6061: Race condition in V8
  • CVE-2018-6062: Heap buffer overflow in Skia
  • CVE-2018-6057: Incorrect permissions on shared memory
  • CVE-2018-6063: Incorrect permissions on shared memory
  • CVE-2018-6064: Type confusion in V8
  • CVE-2018-6065: Integer overflow in V8
  • CVE-2018-6066: Same Origin Bypass via canvas
  • CVE-2018-6067: Buffer overflow in Skia
  • CVE-2018-6068: Object lifecycle issues in Chrome Custom Tab
  • CVE-2018-6069: Stack buffer overflow in Skia
  • CVE-2018-6070: CSP bypass through extensions
  • CVE-2018-6071: Heap bufffer overflow in Skia
  • CVE-2018-6072: Integer overflow in PDFium
  • CVE-2018-6073: Heap bufffer overflow in WebGL
  • CVE-2018-6074: Mark-of-the-Web bypass
  • CVE-2018-6075: Overly permissive cross origin downloads
  • CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink
  • CVE-2018-6077: Timing attack using SVG filters
  • CVE-2018-6078: URL Spoof in OmniBox
  • CVE-2018-6079: Information disclosure via texture data in WebGL
  • CVE-2018-6080: Information disclosure in IPC call
  • CVE-2018-6081: XSS in interstitials
  • CVE-2018-6082: Circumvention of port blocking
  • CVE-2018-6083: Incorrect processing of AppManifests
  • CVE-2018-6121: Privilege Escalation in extensions
  • CVE-2018-6122: Type confusion in V8
  • CVE-2018-6120: Heap buffer overflow in PDFium
  • bsc#1086124: Various fixes from internal audits, fuzzing and other initiatives

This update also supports mitigation against the Spectre vulnerabilities:

'Strict site isolation' is disabled for most users and can be turned on via: chrome://flags/#enable-site-per-process

This feature is undergoing a small percentage trial. Out out of the trial is possible via: chrome://flags/#site-isolation-trial-opt-out

The following tracked packaging bug were fixed:

  • Chromium could not be installed from SUSE PackageHub 12 without having the SDK enabled (bsc#1070421)
  • Chromium could not be installed when libminizip1 was not available (bsc#1093031)
Record
openSUSE-SU-2018:1175-1
Updated
2026-11-02
OSVopenSUSE-SU-2018:1437-1 No score

Security update for Chromium

This update for Chromium to version 66.0.3359.181 fixes the following issues:

  • CVE-2018-6118: Use after free in Media Cache (bsc#1091288)
  • CVE-2018-6085: Use after free in Disk Cache
  • CVE-2018-6086: Use after free in Disk Cache
  • CVE-2018-6087: Use after free in WebAssembly
  • CVE-2018-6088: Use after free in PDFium
  • CVE-2018-6089: Same origin policy bypass in Service Worker
  • CVE-2018-6090: Heap buffer overflow in Skia
  • CVE-2018-6091: Incorrect handling of plug-ins by Service Worker
  • CVE-2018-6092: Integer overflow in WebAssembly
  • CVE-2018-6093: Same origin bypass in Service Worker
  • CVE-2018-6094: Exploit hardening regression in Oilpan
  • CVE-2018-6095: Lack of meaningful user interaction requirement before file upload
  • CVE-2018-6096: Fullscreen UI spoof
  • CVE-2018-6097: Fullscreen UI spoof
  • CVE-2018-6098: URL spoof in Omnibox
  • CVE-2018-6099: CORS bypass in ServiceWorker
  • CVE-2018-6100: URL spoof in Omnibox
  • CVE-2018-6101: Insufficient protection of remote debugging prototol in DevTools
  • CVE-2018-6102: URL spoof in Omnibox
  • CVE-2018-6103: UI spoof in Permissions
  • CVE-2018-6104: URL spoof in Omnibox
  • CVE-2018-6105: URL spoof in Omnibox
  • CVE-2018-6106: Incorrect handling of promises in V8
  • CVE-2018-6107: URL spoof in Omnibox
  • CVE-2018-6108: URL spoof in Omnibox
  • CVE-2018-6109: Incorrect handling of files by FileAPI
  • CVE-2018-6110: Incorrect handling of plaintext files via file://
  • CVE-2018-6111: Heap-use-after-free in DevTools
  • CVE-2018-6112: Incorrect URL handling in DevTools
  • CVE-2018-6113: URL spoof in Navigation
  • CVE-2018-6114: CSP bypass
  • CVE-2018-6115: SmartScreen bypass in downloads
  • CVE-2018-6116: Incorrect low memory handling in WebAssembly
  • CVE-2018-6117: Confusing autofill settings
  • CVE-2017-11215: Use after free in Flash
  • CVE-2017-11225: Use after free in Flash
  • CVE-2018-6060: Use after free in Blink
  • CVE-2018-6061: Race condition in V8
  • CVE-2018-6062: Heap buffer overflow in Skia
  • CVE-2018-6057: Incorrect permissions on shared memory
  • CVE-2018-6063: Incorrect permissions on shared memory
  • CVE-2018-6064: Type confusion in V8
  • CVE-2018-6065: Integer overflow in V8
  • CVE-2018-6066: Same Origin Bypass via canvas
  • CVE-2018-6067: Buffer overflow in Skia
  • CVE-2018-6068: Object lifecycle issues in Chrome Custom Tab
  • CVE-2018-6069: Stack buffer overflow in Skia
  • CVE-2018-6070: CSP bypass through extensions
  • CVE-2018-6071: Heap bufffer overflow in Skia
  • CVE-2018-6072: Integer overflow in PDFium
  • CVE-2018-6073: Heap bufffer overflow in WebGL
  • CVE-2018-6074: Mark-of-the-Web bypass
  • CVE-2018-6075: Overly permissive cross origin downloads
  • CVE-2018-6076: Incorrect handling of URL fragment identifiers in Blink
  • CVE-2018-6077: Timing attack using SVG filters
  • CVE-2018-6078: URL Spoof in OmniBox
  • CVE-2018-6079: Information disclosure via texture data in WebGL
  • CVE-2018-6080: Information disclosure in IPC call
  • CVE-2018-6081: XSS in interstitials
  • CVE-2018-6082: Circumvention of port blocking
  • CVE-2018-6083: Incorrect processing of AppManifests
  • CVE-2018-6121: Privilege Escalation in extensions
  • CVE-2018-6122: Type confusion in V8
  • CVE-2018-6120: Heap buffer overflow in PDFium
  • bsc#1086124: Various fixes from internal audits, fuzzing and other initiatives

This update also supports mitigation against the Spectre vulnerabilities:

'Strict site isolation' is disabled for most users and can be turned on via: chrome://flags/#enable-site-per-process

This feature is undergoing a small percentage trial. Out out of the trial is possible via: chrome://flags/#site-isolation-trial-opt-out

The following tracked packaging bug were fixed:

  • Chromium could not be installed from SUSE PackageHub 12 without having the SDK enabled (bsc#1070421)
  • Chromium could not be installed when libminizip1 was not available (bsc#1093031)
Record
openSUSE-SU-2018:1437-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:10681-1 No score

chromedriver-93.0.4577.82-1.1 on GA media

These are all security issues fixed in the chromedriver-93.0.4577.82-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10681-1
Updated
2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score

ungoogled-chromium-113.0.5672.92-1.1 on GA media

These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:12948-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
chromium-browser
Debian:9
 before 67.0.3396.87-1~deb9u1, plus listed versions
59.0.3071.104-159.0.3071.86-160.0.3112.72-160.0.3112.78-160.0.3112.78-1~deb9u1
Show 36 moreShow less
61.0.3163.100-161.0.3163.100-1~deb9u161.0.3163.100-262.0.3202.75-162.0.3202.75-1~deb9u162.0.3202.89-162.0.3202.89-1~deb9u163.0.3239.30-163.0.3239.40-163.0.3239.84-163.0.3239.84-1~deb9u164.0.3282.119-164.0.3282.119-1~deb9u164.0.3282.119-265.0.3325.146-165.0.3325.146-265.0.3325.146-365.0.3325.146-465.0.3325.73-165.0.3325.74-166.0.3359.117-166.0.3359.117-1~deb9u166.0.3359.139-166.0.3359.181-166.0.3359.22-166.0.3359.22-266.0.3359.22-366.0.3359.26-166.0.3359.26-267.0.3396.48-167.0.3396.56-167.0.3396.57-167.0.3396.62-167.0.3396.62-267.0.3396.79-167.0.3396.79-2
67.0.3396.87-1~deb9u1
chromium-browser-stable
Mageia:6
 before 67.0.3396.62-1.mga6
67.0.3396.62-1.mga6
chromium-browser
Red Hat:rhel_extras:6
 before 0:66.0.3359.139-1.el6_9
0:66.0.3359.139-1.el6_9
chromium-browser-debuginfo
Red Hat:rhel_extras:6
 before 0:66.0.3359.139-1.el6_9
0:66.0.3359.139-1.el6_9
chromium-browser
Ubuntu:16.04:LTS
 before 66.0.3359.139-0ubuntu0.16.04.3, plus listed versions
45.0.2454.101-0ubuntu1.120147.0.2526.73-0ubuntu1.121847.0.2526.106-0ubuntu1.122148.0.2564.82-0ubuntu1.122248.0.2564.116-0ubuntu1.1229
Show 29 moreShow less
49.0.2623.87-0ubuntu1.123249.0.2623.108-0ubuntu1.123350.0.2661.102-0ubuntu0.16.04.1.123751.0.2704.79-0ubuntu0.16.04.1.124252.0.2743.116-0ubuntu0.16.04.1.125053.0.2785.143-0ubuntu0.16.04.1.125453.0.2785.143-0ubuntu0.16.04.1.125755.0.2883.87-0ubuntu0.16.04.126356.0.2924.76-0ubuntu0.16.04.126857.0.2987.98-0ubuntu0.16.04.127658.0.3029.81-0ubuntu0.16.04.127758.0.3029.96-0ubuntu0.16.04.127958.0.3029.110-0ubuntu0.16.04.128159.0.3071.109-0ubuntu0.16.04.128959.0.3071.109-0ubuntu0.16.04.129160.0.3112.78-0ubuntu0.16.04.129360.0.3112.113-0ubuntu0.16.04.129861.0.3163.79-0ubuntu0.16.04.130061.0.3163.100-0ubuntu0.16.04.130662.0.3202.62-0ubuntu0.16.04.130862.0.3202.75-0ubuntu0.16.04.131362.0.3202.89-0ubuntu0.16.04.131562.0.3202.94-0ubuntu0.16.04.131763.0.3239.84-0ubuntu0.16.04.163.0.3239.132-0ubuntu0.16.04.164.0.3282.119-0ubuntu0.16.04.164.0.3282.140-0ubuntu0.16.04.164.0.3282.167-0ubuntu0.16.04.165.0.3325.181-0ubuntu0.16.04.1
66.0.3359.139-0ubuntu0.16.04.3
oxide-qt
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.9.5-0ubuntu11.10.3-0ubuntu0.15.10.11.10.3-0ubuntu0.15.10.21.11.3-0ubuntu31.11.4-0ubuntu1
Show 17 moreShow less
1.11.5-0ubuntu11.12.5-0ubuntu11.12.6-0ubuntu11.12.7-0ubuntu11.13.6-0ubuntu11.14.7-0ubuntu11.14.9-0ubuntu0.16.04.11.15.7-0ubuntu0.16.04.11.15.8-0ubuntu0.16.04.11.16.5-0ubuntu0.16.04.11.17.7-0ubuntu0.16.04.11.17.9-0ubuntu0.16.04.11.18.3-0ubuntu0.16.04.11.18.5-0ubuntu0.16.04.11.19.4-0ubuntu0.16.04.11.20.4-0ubuntu0.16.04.11.21.5-0ubuntu0.16.04.1
 None known
chromium-browser
Ubuntu:18.04:LTS
 before 66.0.3359.139-0ubuntu0.18.04.3, plus listed versions
61.0.3163.100-0ubuntu1.137862.0.3202.62-0ubuntu0.17.10.138062.0.3202.89-0ubuntu1.138662.0.3202.94-0ubuntu1.138863.0.3239.84-0ubuntu1
Show 6 moreShow less
63.0.3239.108-0ubuntu164.0.3282.119-0ubuntu164.0.3282.140-0ubuntu164.0.3282.167-0ubuntu165.0.3325.146-0ubuntu165.0.3325.181-0ubuntu1
66.0.3359.139-0ubuntu0.18.04.3
chromium
SUSE:Package Hub 12 SP2
 before 66.0.3359.181-55.1
66.0.3359.181-55.1
chromium
openSUSE:Tumbleweed
 before 93.0.4577.82-1.1
93.0.4577.82-1.1
chromium
openSUSE:Tumbleweed
 before 113.0.5672.92-1.1
113.0.5672.92-1.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-6118 is a high vulnerability (CVSS 8.8) in Google Chrome, published May 27, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.91%, the 79th percentile. Fixed in chromium-browser 67.0.3396.87-1~deb9u1.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 2,141 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open