VulnerabilityModified

CVE-2018-6084

Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via an executable file.

EXPLOIT ✓HIGH 7.8EPSS 1.10%

Does this matter?

A public exploit is published in Exploit-DB (verified) and the impact is high, while EPSS rates exploitation at 1.1%. Anyone can run this; patch or mitigate before the next change window and check exposed instances for signs of use.

Description

Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117 allowed a local attacker to execute arbitrary code via an executable file.

CVSS 3.0: 7.8 HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 1.10% probability · 65th percentile
Public exploits: 1 in Exploit-DB · verified · first 20 March 2018
CISA KEV: Not listed
Weakness: CWE-20
Affected: google/chrome · debian/debian linux · redhat/enterprise linux desktop · redhat/enterprise linux server · redhat/enterprise linux workstation
Source: chrome-cve-admin@google.com

EPSS trend

EPSS 1.1% since 27 October 2026; no change recorded yet. Points are recorded when the score first appears and whenever it moves by a percentage point or more.

Public exploits (1)

Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.

EDB-ID	Title	Type	Published	Verified
EDB-44307 source ↗	Google Software Updater macOS - Unsafe use of Distributed Objects Privilege Escalationmacos · Google Security Research	local	20 March 2018	yes

References

Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.