high 8.8

CVE-2018-18356 json

An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to p…

published 2018-12-11 7y ago modified 2026-06-17 4mo ago also EUVD-2018-10087

cvss: 8.8; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 3.3%; EPSS 3.3% chance of exploitation in 30 days, percentile 88%
public exploits: 0; none known

An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Patch / fix

fixed in 1 distros 7

Google Chrome 71.0.3578.80

debian ubuntu red hat suse opensuse alpine arch linux

chromium Debian 14, Debian 13, Debian 12 71.0.3578.80-1
firefox-esr Debian 14, Debian 13, Debian 12 60.5.1esr-1
thunderbird Debian 14, Debian 13, Debian 12 1:60.5.1-1

debian advisories DEBIAN-CVE-2018-18356

firefox Ubuntu 14.04 LTS 65.0.1+build2-0ubuntu0.14.04.1
firefox Ubuntu 16.04 LTS 65.0.1+build2-0ubuntu0.16.04.1
firefox Ubuntu 18.04 LTS 65.0.1+build2-0ubuntu0.18.04.1
thunderbird Ubuntu 14.04 LTS 1:60.5.1+build2-0ubuntu0.14.04.1
thunderbird Ubuntu 16.04 LTS 1:60.5.1+build2-0ubuntu0.16.04.1
thunderbird Ubuntu 18.04 LTS 1:60.5.1+build2-0ubuntu0.18.04.1
chromium-browser Ubuntu 16.04 LTS 71.0.3578.80-0ubuntu0.16.04.1
chromium-browser Ubuntu 18.04 LTS 71.0.3578.80-0ubuntu0.18.04.1

ubuntu advisories UBUNTU-CVE-2018-18356

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

thunderbird RHEL 8 60.6.1-1.el8
thunderbird RHEL 7 60.6.1-1.el7_6
thunderbird RHEL 6 60.6.1-1.el6_10
firefox RHEL 7 60.5.1-1.el7_6
firefox RHEL 6 60.5.1-1.el6_10
chromium-browser RHEL 6 EXTRAS 71.0.3578.80-1.el6_10

red hat advisories RHSA-2019:1144 RHSA-2019:0681 RHSA-2019:0680 RHSA-2019:0374 RHSA-2019:0373 RHSA-2018:3803

MozillaFirefox SLE Module for Desktop Applications 15 60.6.1-3.29.3
MozillaThunderbird SLE Workstation Extension 15 60.6.1-3.28.1
MozillaFirefox SLES for SAP 12 SP4, SLES for SAP 12 SP3, SLES for SAP 12 SP2 +13 more 60.6.1esr-109.63.2
MozillaThunderbird SLE Workstation Extension 15 60.5.1-3.24.1

suse advisories SUSE-SU-2019:0871-1 SUSE-SU-2019:0853-1 SUSE-SU-2019:0852-1 SUSE-SU-2019:0469-1

firefox-esr openSUSE Tumbleweed 128.5.1-1.1
MozillaFirefox openSUSE Tumbleweed 92.0-1.2
MozillaThunderbird openSUSE Tumbleweed 91.1.1-1.1
chromium openSUSE Tumbleweed 93.0.4577.82-1.1
chromium openSUSE Tumbleweed 113.0.5672.92-1.1
MozillaThunderbird openSUSE Leap 15.0 60.6.1-lp150.3.37.1
MozillaThunderbird Package Hub 12 60.5.1-79.1
chromium Package Hub 12 SP2 71.0.3578.98-80.1

opensuse advisories openSUSE-SU-2024:14572-1 openSUSE-SU-2024:10600-1 openSUSE-SU-2024:10601-1 openSUSE-SU-2024:10681-1 openSUSE-SU-2024:12948-1 openSUSE-SU-2019:1162-1

firefox-esr Alpine 3.23, Alpine 3.22, Alpine 3.21 +12 more 60.5.2-r0

alpine advisories ALPINE-CVE-2018-18356

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

chromium Arch Linux 71.0.3578.80-1
firefox Arch Linux 65.0.1-1
thunderbird Arch Linux 60.5.1-1

arch linux advisories AVG-824 AVG-896 AVG-908

Is CVE-2018-18356 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-18356 updated 2026-11-04 cvss 8.8

mozilla: Use after free in Skia

Red Hat Enterprise Linux AppStream (v. 8) thunderbird 60.6.1-1.el8
fixed: vendor fix RHSA-2019:1144
Red Hat Enterprise Linux Client (v. 7) firefox 60.5.1-1.el7_6, thunderbird 60.6.1-1.el7_6 Red Hat Enterprise Linux Client Optional (v. 7) firefox 60.5.1-1.el7_6
fixed: vendor fix RHSA-2019:0374
Red Hat Enterprise Linux Desktop (v. 6) firefox 60.5.1-1.el6_10, thunderbird 60.6.1-1.el6_10 Red Hat Enterprise Linux Desktop Optional (v. 6) firefox 60.5.1-1.el6_10
fixed: vendor fix RHSA-2019:0373
Red Hat Enterprise Linux Desktop Supplementary (v. 6) chromium-browser 71.0.3578.80-1.el6_10
fixed: vendor fix RHSA-2018:3803
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) firefox 60.5.1-1.el7_6
fixed: vendor fix RHSA-2019:0374
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) thunderbird 60.6.1-1.el7_6
fixed: vendor fix RHSA-2019:0681
Red Hat Enterprise Linux HPC Node Optional (v. 6) firefox 60.5.1-1.el6_10 Red Hat Enterprise Linux Server (v. 6) firefox 60.5.1-1.el6_10
fixed: vendor fix RHSA-2019:0373
Red Hat Enterprise Linux Server (v. 7) firefox 60.5.1-1.el7_6
fixed: vendor fix RHSA-2019:0374

show 9 more

Red Hat Enterprise Linux Server Optional (v. 6) firefox 60.5.1-1.el6_10, thunderbird 60.6.1-1.el6_10
fixed: vendor fix RHSA-2019:0373
Red Hat Enterprise Linux Server Optional (v. 7) firefox 60.5.1-1.el7_6, thunderbird 60.6.1-1.el7_6
fixed: vendor fix RHSA-2019:0374
Red Hat Enterprise Linux Server Supplementary (v. 6) chromium-browser 71.0.3578.80-1.el6_10
fixed: vendor fix RHSA-2018:3803
Red Hat Enterprise Linux Workstation (v. 6) firefox 60.5.1-1.el6_10, thunderbird 60.6.1-1.el6_10
fixed: vendor fix RHSA-2019:0373
Red Hat Enterprise Linux Workstation (v. 7) firefox 60.5.1-1.el7_6, thunderbird 60.6.1-1.el7_6
fixed: vendor fix RHSA-2019:0374
Red Hat Enterprise Linux Workstation Optional (v. 6) firefox 60.5.1-1.el6_10
fixed: vendor fix RHSA-2019:0373
Red Hat Enterprise Linux Workstation Optional (v. 7) firefox 60.5.1-1.el7_6
fixed: vendor fix RHSA-2019:0374
Red Hat Enterprise Linux Workstation Supplementary (v. 6) chromium-browser 71.0.3578.80-1.el6_10
fixed: vendor fix RHSA-2018:3803
Red Hat Enterprise Linux 8 firefox
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

3.28% chance of exploitation in the next 30 days, higher than 88% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.0	8.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

Google Chrome

Classification

Weakness

CWE-190 Integer Overflow or Wraparound
CWE-416 Use After Free
CWE-787 Out-of-bounds Write

Technology feeds

Google Chrome rss critical rss

References

access.redhat.com /errata/RHSA-2019:0373
vendor-advisory
usn.ubuntu.com /3897-1/
vendor-advisory
security.gentoo.org /glsa/201903-04
vendor-advisory
usn.ubuntu.com /3896-1/
vendor-advisory
access.redhat.com /errata/RHSA-2019:0374
vendor-advisory
debian.org /security/2019/dsa-4391
vendor-advisory
access.redhat.com /errata/RHSA-2018:3803
vendor-advisory
debian.org /security/2019/dsa-4392
vendor-advisory
debian.org /security/2018/dsa-4352
vendor-advisory
security.gentoo.org /glsa/201904-07
vendor-advisory
lists.opensuse.org /opensuse-security-announce/2019-04/msg00043.html
vendor-advisory
access.redhat.com /errata/RHSA-2019:1144
vendor-advisory
security.gentoo.org /glsa/201908-18
vendor-advisory
crbug.com /883666
lists.debian.org /debian-lts-announce/2019/02/msg00023.html
mailing-list
lists.debian.org /debian-lts-announce/2019/02/msg00024.html
mailing-list
chromereleases.googleblog.com /2018/12/stable-channel-update-for-desktop.html
securityfocus.com /bid/106084
vdb-entry

Sources

CVE List CVE-2018-18356
NVD CVE-2018-18356

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json all entries feed