V8 out-of-bounds write in Google Chrome array deserialization

Successful exploitation allows arbitrary code execution within the Chrome sandbox. In observed threat activity, the vulnerability was used as part of mobile exploitation chains to deliver additional malware stages. Because the provided content specifies execution inside the sandbox, further compromise beyond the renderer context would require additional post-exploitation steps or chained vulnerabilities not described here.

Until patching is complete, reduce exposure by restricting access to untrusted or attacker-controlled web content, especially links delivered through messaging platforms and social engineering lures. Use application and OS versions that do not expose vulnerable Chrome/V8 builds, and prevent downgrade or replacement of embedded browser components where possible. Enterprise controls such as URL filtering, mobile threat defense, and browser/app update enforcement can reduce exploitation opportunities.

Upgrade Google Chrome to version 71.0.3578.80 or later, as the vulnerability affects versions prior to 71.0.3578.80. On Android, ensure Chromium-based browsers and embedded browser components used by applications are updated to patched versions. Remove or replace outdated vulnerable browser engines in applications that bundle or depend on Chromium-derived components.