CVE-2017-5088
Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.104 for Mac,...
Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.104 for Mac, Windows, and Linux, and 59.0.3071.117 for Android, allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.104 for Mac, Windows, and Linux, and 59.0.3071.117 for Android, allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
- Record
CVE-2017-5088- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-125
- Updated
- 2026-11-02
CVE List No score
Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.104 for Mac, Windows, and Linux, and 59.0.3071.117 for Android, allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
- Record
CVE-2017-5088- Updated
- 2026-11-02
EUVDEUVD-2017-14197 No score
Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.104 for Mac, Windows, and Linux, and 59.0.3071.117 for Android, allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
- Record
EUVD-2017-14197- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-r64f-38v8-w4ff
Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.104 for Mac,...
Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.104 for Mac, Windows, and Linux, and 59.0.3071.117 for Android, allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
- Record
GHSA-r64f-38v8-w4ff- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-125
- Updated
- 2026-11-02
OSVRHSA-2017:1495
Red Hat Security Advisory: chromium-browser security update
- Record
RHSA-2017:1495- CVSS 3.0
- 9.6 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2017-5088
Insufficient validation of untrusted input in V8 in Google Chrome prior to 59.0.3071.104 for Mac, Windows, and Linux, and 59.0.3071.117 for Android, allowed a remote attacker to perform out of bounds memory access via a crafted HTML page.
- Record
UBUNTU-CVE-2017-5088- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVMGASA-2017-0317 No score
Chromium-browser 60.0.3112.101 fixes security issues
Multiple flaws were found in the way Chromium 57 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information. (CVE-2017-5057, CVE-2017-5058, CVE-2017-5059, CVE-2017-5060, CVE-2017-5061, CVE-2017-5062, CVE-2017-5063, CVE-2017-5064, CVE-2017-5065, CVE-2017-5066, CVE-2017-5067, CVE-2017-5068, CVE-2017-5069, CVE-2017-5070, CVE-2017-5071, CVE-2017-5072, CVE-2017-5073, CVE-2017-5074, CVE-2017-5075, CVE-2017-5076, CVE-2017-5077, CVE-2017-5078, CVE-2017-5079, CVE-2017-5080, CVE-2017-5081, CVE-2017-5082, CVE-2017-5083, CVE-2017-5085, CVE-2017-5086, CVE-2017-5087, CVE-2017-5088, CVE-2017-5089, CVE-2017-5091, CVE-2017-5092, CVE-2017-5093, CVE-2017-5094, CVE-2017-5095, CVE-2017-5096, CVE-2017-5097, CVE-2017-5098, CVE-2017-5099, CVE-2017-5100, CVE-2017-5101, CVE-2017-5102, CVE-2017-5103, CVE-2017-5104, CVE-2017-5105, CVE-2017-5106, CVE-2017-5107, CVE-2017-5108, CVE-2017-5109, CVE-2017-5110, CVE-2017-6991)
- Record
MGASA-2017-0317- Updated
- 2026-11-02
OSVopenSUSE-SU-2017:1591-1 No score
Security update for chromium
This update to Chromium 59.0.3071.104 fixes the following security issues:
- CVE-2017-5087: Sandbox Escape in IndexedDB
- CVE-2017-5088: Out of bounds read in V8
- CVE-2017-5089: Domain spoofing in Omnibox
- Various fixes from internal audits, fuzzing and other initiatives
The following tracked packaging changes are included:
- In about dialog, refer to the build as 'openSUSE build' (boo#1043420)
- Record
openSUSE-SU-2017:1591-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2017:1593-1 No score
Security update for chromium
This update to Chromium 59.0.3071.104 fixes the following security issues:
- CVE-2017-5087: Sandbox Escape in IndexedDB
- CVE-2017-5088: Out of bounds read in V8
- CVE-2017-5089: Domain spoofing in Omnibox
- Various fixes from internal audits, fuzzing and other initiatives
The following tracked packaging changes are included:
- In about dialog, refer to the build as 'openSUSE build' (boo#1043420)
- Record
openSUSE-SU-2017:1593-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10681-1 No score
chromedriver-93.0.4577.82-1.1 on GA media
These are all security issues fixed in the chromedriver-93.0.4577.82-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10681-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score
ungoogled-chromium-113.0.5672.92-1.1 on GA media
These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12948-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromium-browserDebian:9 From an advisory covering 23 CVEs |
before 60.0.3112.78-1~deb9u1, plus listed versions 59.0.3071.104-159.0.3071.86-160.0.3112.72-1 |
60.0.3112.78-1~deb9u1 |
chromium-browser-stableMageia:5 From an advisory covering 51 CVEs |
before 60.0.3112.101-1.mga5 | 60.0.3112.101-1.mga5 |
libwebpMageia:5 From an advisory covering 51 CVEs |
before 0.4.3-1.1.mga5 | 0.4.3-1.1.mga5 |
chromium-browser-stableMageia:6 From an advisory covering 51 CVEs |
before 60.0.3112.101-1.mga6 | 60.0.3112.101-1.mga6 |
chromium-browserRed Hat:rhel_extras:6 From an advisory covering 3 CVEs |
before 0:59.0.3071.104-1.el6_9 | 0:59.0.3071.104-1.el6_9 |
chromium-browser-debuginfoRed Hat:rhel_extras:6 From an advisory covering 3 CVEs |
before 0:59.0.3071.104-1.el6_9 | 0:59.0.3071.104-1.el6_9 |
chromium-browserUbuntu:14.04:LTS |
before 59.0.3071.109-0ubuntu0.14.04.1186, plus listed versions 29.0.1547.65-0ubuntu231.0.1650.63-0ubuntu1~20131204.132.0.1700.107-0ubuntu1~20140204.977.133.0.1750.152-0ubuntu1~pkg995.134.0.1847.116-0ubuntu2 Show 27 moreShow less36.0.1985.125-0ubuntu1.14.04.0~pkg102937.0.2062.94-0ubuntu0.14.04.1~pkg104237.0.2062.120-0ubuntu0.14.04.1~pkg104938.0.2125.111-0ubuntu0.14.04.1.106139.0.2171.65-0ubuntu0.14.04.1.106440.0.2214.94-0ubuntu0.14.04.1.106840.0.2214.111-0ubuntu0.14.04.1.106941.0.2272.76-0ubuntu0.14.04.1.107643.0.2357.81-0ubuntu0.14.04.1.108943.0.2357.130-0ubuntu0.14.04.1.109244.0.2403.89-0ubuntu0.14.04.1.109545.0.2454.85-0ubuntu0.14.04.1.109745.0.2454.101-0ubuntu0.14.04.1.109947.0.2526.73-0ubuntu0.14.04.1.110647.0.2526.106-0ubuntu0.14.04.1.110748.0.2564.82-0ubuntu0.14.04.1.110848.0.2564.116-0ubuntu0.14.04.1.111149.0.2623.87-0ubuntu0.14.04.1.111249.0.2623.108-0ubuntu0.14.04.1.111350.0.2661.102-0ubuntu0.14.04.1.111751.0.2704.79-0ubuntu0.14.04.1.112152.0.2743.116-0ubuntu0.14.04.1.113453.0.2785.143-0ubuntu0.14.04.1.114253.0.2785.143-0ubuntu0.14.04.1.114558.0.3029.81-0ubuntu0.14.04.117258.0.3029.96-0ubuntu0.14.04.117458.0.3029.110-0ubuntu0.14.04.1176 |
59.0.3071.109-0ubuntu0.14.04.1186 |
chromium-browserUbuntu:16.04:LTS |
before 59.0.3071.109-0ubuntu0.16.04.1289, plus listed versions 45.0.2454.101-0ubuntu1.120147.0.2526.73-0ubuntu1.121847.0.2526.106-0ubuntu1.122148.0.2564.82-0ubuntu1.122248.0.2564.116-0ubuntu1.1229 Show 13 moreShow less49.0.2623.87-0ubuntu1.123249.0.2623.108-0ubuntu1.123350.0.2661.102-0ubuntu0.16.04.1.123751.0.2704.79-0ubuntu0.16.04.1.124252.0.2743.116-0ubuntu0.16.04.1.125053.0.2785.143-0ubuntu0.16.04.1.125453.0.2785.143-0ubuntu0.16.04.1.125755.0.2883.87-0ubuntu0.16.04.126356.0.2924.76-0ubuntu0.16.04.126857.0.2987.98-0ubuntu0.16.04.127658.0.3029.81-0ubuntu0.16.04.127758.0.3029.96-0ubuntu0.16.04.127958.0.3029.110-0ubuntu0.16.04.1281 |
59.0.3071.109-0ubuntu0.16.04.1289 |
oxide-qtUbuntu:16.04:LTS |
All versions, plus listed versions 1.9.5-0ubuntu11.10.3-0ubuntu0.15.10.11.10.3-0ubuntu0.15.10.21.11.3-0ubuntu31.11.4-0ubuntu1 Show 17 moreShow less1.11.5-0ubuntu11.12.5-0ubuntu11.12.6-0ubuntu11.12.7-0ubuntu11.13.6-0ubuntu11.14.7-0ubuntu11.14.9-0ubuntu0.16.04.11.15.7-0ubuntu0.16.04.11.15.8-0ubuntu0.16.04.11.16.5-0ubuntu0.16.04.11.17.7-0ubuntu0.16.04.11.17.9-0ubuntu0.16.04.11.18.3-0ubuntu0.16.04.11.18.5-0ubuntu0.16.04.11.19.4-0ubuntu0.16.04.11.20.4-0ubuntu0.16.04.11.21.5-0ubuntu0.16.04.1 |
None known |
libv8-3.14Ubuntu:16.04:LTS |
All versions, plus listed versions 3.14.5.8-5ubuntu2 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libv8-3.14Ubuntu:18.04:LTS |
All versions, plus listed versions 3.14.5.8-11ubuntu1 |
None known |
chromiumSUSE:Package Hub 12 SP2 From an advisory covering 3 CVEs |
before 59.0.3071.104-23.1 | 59.0.3071.104-23.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 1081 CVEs |
before 93.0.4577.82-1.1 | 93.0.4577.82-1.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 2310 CVEs |
before 113.0.5672.92-1.1 | 113.0.5672.92-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-5088 is a high vulnerability (CVSS 8.8) in Google Chrome, published June 18, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.15%, the 88th percentile. Fixed in chromium-browser 59.0.3071.109-0ubuntu0.14.04.1186.
References
securitytracker.com/id/1038765
crbug.com/729991
securityfocus.com/bid/99096
debian.org/security/2017/dsa-3926
access.redhat.com/errata/RHSA-2017:1495
security.gentoo.org/glsa/201706-20
Show 194 moreShow less
chromereleases.googleblog.com/2017/06/stable-channel-update-for-desktop_15.html
nvd.nist.gov/vuln/detail/CVE-2017-5088
github.com/advisories/GHSA-r64f-38v8-w4ff
advisories.mageia.org/MGASA-2017-0317.html
bugs.mageia.org/show_bug.cgi?id=20708
bugzilla.redhat.com/show_bug.cgi?id=1462148
security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1495.json
cve.org/CVERecord?id=CVE-2017-5087
ubuntu.com/security/CVE-2017-5088
bugzilla.suse.com/1043420
suse.com/security/cve/CVE-2017-5087
Left out here: 2,146 references. The JSON record has them.