Loading vulnerability…
CVE-2018-17463 is a V8 engine vulnerability in Google Chrome caused by an incorrect side-effect annotation in the optimizing compiler/JIT pipeline. In Chrome versions prior to 70.0.3538.64, this flaw can lead to type confusion during JavaScript optimization when processing attacker-controlled script delivered through a crafted HTML page. The issue is in V8 rather than a renderer-independent component, and successful triggering allows arbitrary code execution within the Chrome sandbox. Reporting in the provided context also shows the bug was incorporated into the MOONSHINE exploit framework to target vulnerable Chrome 68 and 69 builds on Android/Chromium-based environments.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository contains a Metasploit module that exploits a type confusion vulnerability (CVE-2018-17463) in the JIT compiler of Google Chrome versions 67, 68, and 69. The exploit is delivered via a malicious HTTP server that serves a crafted HTML/JavaScript payload to the victim's browser. If the browser is launched with the --no-sandbox flag, arbitrary code execution is achieved in the renderer process. For Windows 7 x64 targets, the module can leverage CVE-2019-1458 to escape the Chrome sandbox using a DLL payload, potentially leading to SYSTEM-level code execution. The module supports multiple platforms (Windows, OSX, Linux) for the initial exploit, but sandbox escape is only available on Windows 7 x64. The main file is a Ruby script that integrates with Metasploit's browser exploit and payload delivery infrastructure, and it dynamically serves JavaScript and binary payloads to the victim. The exploit is weaponized, allowing the attacker to select and deliver arbitrary Metasploit payloads (such as reverse shells or Meterpreter sessions).
This repository contains a working exploit for CVE-2018-17463, a vulnerability in the V8 JavaScript engine (used in Google Chrome). The main file, CVE-2018-17463.js, is a standalone JavaScript exploit that demonstrates how to achieve arbitrary read/write primitives and ultimately execute arbitrary code by spawning a /bin/sh shell. The exploit works by manipulating object properties to create overlapping memory regions, leveraging JIT (Just-In-Time) compilation behaviors, and constructing a ROP (Return-Oriented Programming) chain to make memory pages executable and run shellcode. The shellcode is provided as a byte array and is executed to spawn a shell, demonstrating full code execution. The README provides references to relevant research and writeups. The exploit is operational and demonstrates a full exploit chain, but is not part of a framework and is intended for research and demonstration purposes. The only fingerprintable endpoint is the use of /bin/sh in the shellcode payload.
This repository contains a working proof-of-concept exploit for CVE-2018-17463, a vulnerability in the V8 JavaScript engine used by Google Chrome prior to version 70.0.3538.64. The exploit is implemented in a single JavaScript file (CVE-2018-17463.js) and leverages a type confusion bug to achieve arbitrary memory read and write primitives. It then uses WebAssembly to allocate a RWX (read-write-execute) memory region, writes x86_64 shellcode to this region, and executes it, resulting in arbitrary code execution (demonstrated by launching calc.exe). The exploit demonstrates advanced exploitation techniques including property overlap discovery, address leaking, and memory corruption. The README provides context, references, and credits, but the main exploit logic is self-contained in the JavaScript file. No network or external endpoints are hardcoded in the exploit; it is designed to be run in a browser context where the vulnerable V8 engine is present.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A Google Chrome vulnerability used as Exploit #6 in the MOONSHINE Android exploit kit.
A Chromium vulnerability targeted by the MOONSHINE exploit kit against Android apps embedding vulnerable Chrome versions 68 and 69.
A Google Chrome vulnerability used by MOONSHINE to exploit Android devices on affected Chrome versions.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.