CVE-2017-5030
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux,...
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page.
- Record
CVE-2017-5030- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page.
- Record
CVE-2017-5030- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
EUVDEUVD-2017-14139
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page.
- Record
EUVD-2017-14139- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6w47-3vvr-m9hm
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux,...
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page.
- Record
GHSA-6w47-3vvr-m9hm- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
CISA KEV No score
Google Chromium V8 Memory Corruption Vulnerability
Google Chromium V8 Engine contains a memory corruption vulnerability that allows a remote attacker to execute code via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Record
CVE-2017-5030- Weakness
- CWE-125
- Updated
- 2026-11-02
OSVRHSA-2017:0499
Red Hat Security Advisory: chromium-browser security update
- Record
RHSA-2017:0499- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 7 moreShow less
OSVUBUNTU-CVE-2017-5030
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a crafted HTML page.
- Record
UBUNTU-CVE-2017-5030- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2017-0111 No score
Updated chromium-browser-stable packages fix security vulnerability
Chromium-browser 57.0.2987.133 fixes security issues:
Multiple flaws were found in the way Chromium 55 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information. (CVE-2017-5006, CVE-2017-5007, CVE-2017-5008, CVE-2017-5009, CVE-2017-5010, CVE-2017-5011, CVE-2017-5012, CVE-2017-5013, CVE-2017-5014, CVE-2017-5015, CVE-2017-5016, CVE-2017-5017, CVE-2017-5018, CVE-2017-5019, CVE-2017-5020, CVE-2017-5021, CVE-2017-5022, CVE-2017-5023, CVE-2017-5024, CVE-2017-5025, CVE-2017-5026, CVE-2017-5027, CVE-2017-5029, CVE-2017-5030, CVE-2017-5031, CVE-2017-5032, CVE-2017-5033, CVE-2017-5034, CVE-2017-5035, CVE-2017-5036, CVE-2017-5037, CVE-2017-5038, CVE-2017-5039, CVE-2017-5040, CVE-2017-5041, CVE-2017-5042, CVE-2017-5043, CVE-2017-5044, CVE-2017-5045, CVE-2017-5046, CVE-2017-5052, CVE-2017-5053, CVE-2017-5054, CVE-2017-5055, CVE-2017-5056)
- Record
MGASA-2017-0111- Updated
- 2026-11-02
OSVopenSUSE-SU-2017:0738-1 No score
Security update for Chromium
Chromium was updated to 57.0.2987.98 to fix security issues and bugs.
The following vulnerabilities were fixed (bsc#1028848):
- CVE-2017-5030: Memory corruption in V8
- CVE-2017-5031: Use after free in ANGLE
- CVE-2017-5032: Out of bounds write in PDFium
- CVE-2017-5029: Integer overflow in libxslt
- CVE-2017-5034: Use after free in PDFium
- CVE-2017-5035: Incorrect security UI in Omnibox
- CVE-2017-5036: Use after free in PDFium
- CVE-2017-5037: Multiple out of bounds writes in ChunkDemuxer
- CVE-2017-5039: Use after free in PDFium
- CVE-2017-5040: Information disclosure in V8
- CVE-2017-5041: Address spoofing in Omnibox
- CVE-2017-5033: Bypass of Content Security Policy in Blink
- CVE-2017-5042: Incorrect handling of cookies in Cast
- CVE-2017-5038: Use after free in GuestView
- CVE-2017-5043: Use after free in GuestView
- CVE-2017-5044: Heap overflow in Skia
- CVE-2017-5045: Information disclosure in XSS Auditor
- CVE-2017-5046: Information disclosure in Blink
The following non-security changes are included:
- Address broken rendering on non-intel cards
- Record
openSUSE-SU-2017:0738-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2017:0740-1 No score
Security update for Chromium
Chromium was updated to 57.0.2987.98 to fix security issues and bugs.
The following vulnerabilities were fixed (bsc#1028848):
- CVE-2017-5030: Memory corruption in V8
- CVE-2017-5031: Use after free in ANGLE
- CVE-2017-5032: Out of bounds write in PDFium
- CVE-2017-5029: Integer overflow in libxslt
- CVE-2017-5034: Use after free in PDFium
- CVE-2017-5035: Incorrect security UI in Omnibox
- CVE-2017-5036: Use after free in PDFium
- CVE-2017-5037: Multiple out of bounds writes in ChunkDemuxer
- CVE-2017-5039: Use after free in PDFium
- CVE-2017-5040: Information disclosure in V8
- CVE-2017-5041: Address spoofing in Omnibox
- CVE-2017-5033: Bypass of Content Security Policy in Blink
- CVE-2017-5042: Incorrect handling of cookies in Cast
- CVE-2017-5038: Use after free in GuestView
- CVE-2017-5043: Use after free in GuestView
- CVE-2017-5044: Heap overflow in Skia
- CVE-2017-5045: Information disclosure in XSS Auditor
- CVE-2017-5046: Information disclosure in Blink
The following non-security changes are included:
- Address broken rendering on non-intel cards
- Record
openSUSE-SU-2017:0740-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10681-1 No score
chromedriver-93.0.4577.82-1.1 on GA media
These are all security issues fixed in the chromedriver-93.0.4577.82-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10681-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score
ungoogled-chromium-113.0.5672.92-1.1 on GA media
These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12948-1- Updated
- 2026-11-02
OSVUSN-3236-1 No score
oxide-qt vulnerabilities
Multiple vulnerabilities were discovered in Chromium. If a user were tricked in to opening a specially crafted website, an attacker could potentially exploit these to obtain sensitive information, spoof application UI by causing the security status API or webview URL to indicate the wrong values, bypass security restrictions, cause a denial of service via application crash, or execute arbitrary code. (CVE-2017-5029, CVE-2017-5030, CVE-2017-5031, CVE-2017-5033, CVE-2017-5035, CVE-2017-5037, CVE-2017-5040, CVE-2017-5041, CVE-2017-5044, CVE-2017-5045, CVE-2017-5046)
- Record
USN-3236-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromium-browserDebian:8 From an advisory covering 18 CVEs |
before 57.0.2987.98-1~deb8u1, plus listed versions 41.0.2272.118-142.0.2311.135-142.0.2311.135-1~deb8u142.0.2311.135-242.0.2311.90-1 Show 45 moreShow less42.0.2311.90-1~deb8u142.0.2311.90-243.0.2357.124-143.0.2357.124-243.0.2357.124-343.0.2357.130-143.0.2357.65-143.0.2357.65-1~deb8u143.0.2357.81-144.0.2403.107-144.0.2403.107-244.0.2403.157-144.0.2403.89-144.0.2403.89-1~deb8u145.0.2454.101-145.0.2454.85-145.0.2454.85-1~deb8u146.0.2490.13-146.0.2490.71-146.0.2490.71-1~deb8u147.0.2526.111-147.0.2526.16-147.0.2526.73-147.0.2526.73-1~deb8u147.0.2526.80-147.0.2526.80-1~deb8u147.0.2526.80-247.0.2526.80-348.0.2564.116-148.0.2564.116-1~deb8u148.0.2564.23-148.0.2564.82-148.0.2564.82-1~deb8u148.0.2564.82-249.0.2623.108-149.0.2623.108-1~deb8u149.0.2623.108-249.0.2623.75-149.0.2623.75-1~deb8u149.0.2623.75-249.0.2623.87-149.0.2623.87-1~deb8u150.0.2661.75-150.0.2661.75-1~deb8u150.0.2661.75-2 |
57.0.2987.98-1~deb8u1 |
chromium-browser-stableMageia:5 From an advisory covering 45 CVEs |
before 57.0.2987.133-1.mga5 | 57.0.2987.133-1.mga5 |
chromium-browserRed Hat:rhel_extras:6 From an advisory covering 18 CVEs |
before 0:57.0.2987.98-1.el6 | 0:57.0.2987.98-1.el6 |
chromium-browser-debuginfoRed Hat:rhel_extras:6 From an advisory covering 18 CVEs |
before 0:57.0.2987.98-1.el6 | 0:57.0.2987.98-1.el6 |
chromium-browserUbuntu:14.04:LTS |
before 58.0.3029.81-0ubuntu0.14.04.1172, plus listed versions 29.0.1547.65-0ubuntu231.0.1650.63-0ubuntu1~20131204.132.0.1700.107-0ubuntu1~20140204.977.133.0.1750.152-0ubuntu1~pkg995.134.0.1847.116-0ubuntu2 Show 24 moreShow less36.0.1985.125-0ubuntu1.14.04.0~pkg102937.0.2062.94-0ubuntu0.14.04.1~pkg104237.0.2062.120-0ubuntu0.14.04.1~pkg104938.0.2125.111-0ubuntu0.14.04.1.106139.0.2171.65-0ubuntu0.14.04.1.106440.0.2214.94-0ubuntu0.14.04.1.106840.0.2214.111-0ubuntu0.14.04.1.106941.0.2272.76-0ubuntu0.14.04.1.107643.0.2357.81-0ubuntu0.14.04.1.108943.0.2357.130-0ubuntu0.14.04.1.109244.0.2403.89-0ubuntu0.14.04.1.109545.0.2454.85-0ubuntu0.14.04.1.109745.0.2454.101-0ubuntu0.14.04.1.109947.0.2526.73-0ubuntu0.14.04.1.110647.0.2526.106-0ubuntu0.14.04.1.110748.0.2564.82-0ubuntu0.14.04.1.110848.0.2564.116-0ubuntu0.14.04.1.111149.0.2623.87-0ubuntu0.14.04.1.111249.0.2623.108-0ubuntu0.14.04.1.111350.0.2661.102-0ubuntu0.14.04.1.111751.0.2704.79-0ubuntu0.14.04.1.112152.0.2743.116-0ubuntu0.14.04.1.113453.0.2785.143-0ubuntu0.14.04.1.114253.0.2785.143-0ubuntu0.14.04.1.1145 |
58.0.3029.81-0ubuntu0.14.04.1172 |
oxide-qtUbuntu:14.04:LTS |
before 1.21.5-0ubuntu0.14.04.1, plus listed versions 1.0.0~bzr437-0ubuntu11.0.0~bzr452-0ubuntu11.0.0~bzr475-0ubuntu11.0.0~bzr490-0ubuntu11.0.0~bzr501-0ubuntu1 Show 35 moreShow less1.0.0~bzr501-0ubuntu21.0.4-0ubuntu0.14.04.11.0.5-0ubuntu0.14.04.11.1.2-0ubuntu0.14.04.11.2.5-0ubuntu0.14.04.11.3.4-0ubuntu0.14.04.11.4.2-0ubuntu0.14.04.11.4.3-0ubuntu0.14.04.11.5.5-0ubuntu0.14.04.31.5.6-0ubuntu0.14.04.21.6.5-0ubuntu0.14.04.11.6.6-0ubuntu0.14.04.11.7.8-0ubuntu0.14.04.11.7.9-0ubuntu0.14.04.11.8.4-0ubuntu0.14.04.21.9.1-0ubuntu0.14.04.21.9.5-0ubuntu0.14.04.11.10.3-0ubuntu0.14.04.11.11.3-0ubuntu0.14.04.11.11.4-0ubuntu0.14.04.11.12.5-0ubuntu0.14.04.11.12.6-0ubuntu0.14.04.11.12.7-0ubuntu0.14.04.11.13.6-0ubuntu0.14.04.11.14.7-0ubuntu0.14.04.11.14.9-0ubuntu0.14.04.11.15.7-0ubuntu0.14.04.11.15.8-0ubuntu0.14.04.11.16.5-0ubuntu0.14.04.11.17.7-0ubuntu0.14.04.11.17.9-0ubuntu0.14.04.11.18.3-0ubuntu0.14.04.11.18.5-0ubuntu0.14.04.11.19.4-0ubuntu0.14.04.11.20.4-0ubuntu0.14.04.1 |
1.21.5-0ubuntu0.14.04.1 |
chromium-browserUbuntu:16.04:LTS |
before 57.0.2987.98-0ubuntu0.16.04.1276, plus listed versions 45.0.2454.101-0ubuntu1.120147.0.2526.73-0ubuntu1.121847.0.2526.106-0ubuntu1.122148.0.2564.82-0ubuntu1.122248.0.2564.116-0ubuntu1.1229 Show 9 moreShow less49.0.2623.87-0ubuntu1.123249.0.2623.108-0ubuntu1.123350.0.2661.102-0ubuntu0.16.04.1.123751.0.2704.79-0ubuntu0.16.04.1.124252.0.2743.116-0ubuntu0.16.04.1.125053.0.2785.143-0ubuntu0.16.04.1.125453.0.2785.143-0ubuntu0.16.04.1.125755.0.2883.87-0ubuntu0.16.04.126356.0.2924.76-0ubuntu0.16.04.1268 |
57.0.2987.98-0ubuntu0.16.04.1276 |
oxide-qtUbuntu:16.04:LTS |
before 1.21.5-0ubuntu0.16.04.1, plus listed versions 1.9.5-0ubuntu11.10.3-0ubuntu0.15.10.11.10.3-0ubuntu0.15.10.21.11.3-0ubuntu31.11.4-0ubuntu1 Show 16 moreShow less1.11.5-0ubuntu11.12.5-0ubuntu11.12.6-0ubuntu11.12.7-0ubuntu11.13.6-0ubuntu11.14.7-0ubuntu11.14.9-0ubuntu0.16.04.11.15.7-0ubuntu0.16.04.11.15.8-0ubuntu0.16.04.11.16.5-0ubuntu0.16.04.11.17.7-0ubuntu0.16.04.11.17.9-0ubuntu0.16.04.11.18.3-0ubuntu0.16.04.11.18.5-0ubuntu0.16.04.11.19.4-0ubuntu0.16.04.11.20.4-0ubuntu0.16.04.1 |
1.21.5-0ubuntu0.16.04.1 |
libv8-3.14Ubuntu:16.04:LTS |
All versions, plus listed versions 3.14.5.8-5ubuntu2 |
None known |
libv8-3.14Ubuntu:18.04:LTS |
All versions, plus listed versions 3.14.5.8-11ubuntu1 |
None known |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
oxide-qtUbuntu:14.04:LTS From an advisory covering 11 CVEs |
before 1.21.5-0ubuntu0.14.04.1, plus listed versions 1.0.0~bzr437-0ubuntu11.0.0~bzr452-0ubuntu11.0.0~bzr475-0ubuntu11.0.0~bzr490-0ubuntu11.0.0~bzr501-0ubuntu1 Show 35 moreShow less1.0.0~bzr501-0ubuntu21.0.4-0ubuntu0.14.04.11.0.5-0ubuntu0.14.04.11.1.2-0ubuntu0.14.04.11.2.5-0ubuntu0.14.04.11.3.4-0ubuntu0.14.04.11.4.2-0ubuntu0.14.04.11.4.3-0ubuntu0.14.04.11.5.5-0ubuntu0.14.04.31.5.6-0ubuntu0.14.04.21.6.5-0ubuntu0.14.04.11.6.6-0ubuntu0.14.04.11.7.8-0ubuntu0.14.04.11.7.9-0ubuntu0.14.04.11.8.4-0ubuntu0.14.04.21.9.1-0ubuntu0.14.04.21.9.5-0ubuntu0.14.04.11.10.3-0ubuntu0.14.04.11.11.3-0ubuntu0.14.04.11.11.4-0ubuntu0.14.04.11.12.5-0ubuntu0.14.04.11.12.6-0ubuntu0.14.04.11.12.7-0ubuntu0.14.04.11.13.6-0ubuntu0.14.04.11.14.7-0ubuntu0.14.04.11.14.9-0ubuntu0.14.04.11.15.7-0ubuntu0.14.04.11.15.8-0ubuntu0.14.04.11.16.5-0ubuntu0.14.04.11.17.7-0ubuntu0.14.04.11.17.9-0ubuntu0.14.04.11.18.3-0ubuntu0.14.04.11.18.5-0ubuntu0.14.04.11.19.4-0ubuntu0.14.04.11.20.4-0ubuntu0.14.04.1 |
1.21.5-0ubuntu0.14.04.1 |
oxide-qtUbuntu:16.04:LTS From an advisory covering 11 CVEs |
before 1.21.5-0ubuntu0.16.04.1, plus listed versions 1.9.5-0ubuntu11.10.3-0ubuntu0.15.10.11.10.3-0ubuntu0.15.10.21.11.3-0ubuntu31.11.4-0ubuntu1 Show 16 moreShow less1.11.5-0ubuntu11.12.5-0ubuntu11.12.6-0ubuntu11.12.7-0ubuntu11.13.6-0ubuntu11.14.7-0ubuntu11.14.9-0ubuntu0.16.04.11.15.7-0ubuntu0.16.04.11.15.8-0ubuntu0.16.04.11.16.5-0ubuntu0.16.04.11.17.7-0ubuntu0.16.04.11.17.9-0ubuntu0.16.04.11.18.3-0ubuntu0.16.04.11.18.5-0ubuntu0.16.04.11.19.4-0ubuntu0.16.04.11.20.4-0ubuntu0.16.04.1 |
1.21.5-0ubuntu0.16.04.1 |
chromiumSUSE:Package Hub 12 SP2 From an advisory covering 18 CVEs |
before 57.0.2987.98-8.1 | 57.0.2987.98-8.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 1081 CVEs |
before 93.0.4577.82-1.1 | 93.0.4577.82-1.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 2310 CVEs |
before 113.0.5672.92-1.1 | 113.0.5672.92-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| exploitation | ||
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-5030 is a high vulnerability (CVSS 8.8) in Debian Linux, published March 10, 2017. CISA lists it as known to be exploited, since June 8, 2022. EUVD reports exploitation since June 8, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 40.6%, the 98th percentile. Fixed in chromium-browser 58.0.3029.81-0ubuntu0.14.04.1172.
References
chromereleases.googleblog.com/2017/03/stable-channel-update-for-desktop.html
security.gentoo.org/glsa/201704-02
crbug.com/682194
debian.org/security/2017/dsa-3810
securityfocus.com/bid/96767
rhn.redhat.com/errata/RHSA-2017-0499.html
Show 194 moreShow less
zerodayinitiative.com/advisories/ZDI-20-126
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-5030
nvd.nist.gov/vuln/detail/CVE-2017-5030
github.com/advisories/GHSA-6w47-3vvr-m9hm
advisories.mageia.org/MGASA-2017-0111.html
bugs.mageia.org/show_bug.cgi?id=20187
access.redhat.com/errata/RHSA-2017:0499
bugzilla.redhat.com/show_bug.cgi?id=1431030
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_0499.json
cve.org/CVERecord?id=CVE-2017-5029
ubuntu.com/security/CVE-2017-5030
lists.opensuse.org/archives/list/[email protected]/thread/CGEJIAKNREDZSMA4I6FRAI6U2CLXZKIO
bugzilla.suse.com/1028848
suse.com/security/cve/CVE-2017-5029
Left out here: 42 versions and 2,230 references. The JSON record has them.