CVEvulnerability

CVE-2016-1646

8.8 HIGH Known exploited Published 2016-03-29 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Google Chromium V8 Out-of-Bounds Read Vulnerability — Google Chromium V8

Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Added to KEV
2022-06-08
Remediation due
2022-06-22
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2016-1646
Status
Analyzed
Published
2016-03-29
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
9.3 HIGH — AV:N/AC:M/Au:N/C:C/I:C/A:C
Weaknesses
CWE-125

Description

The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.

Affected configurations

• debian debian linux 8.0 • debian debian linux 9.0 • canonical ubuntu linux 14.04 • canonical ubuntu linux 15.10 • canonical ubuntu linux 16.04 • google chrome (< 49.0.2623.108) • suse package hub • opensuse leap 42.1 • opensuse opensuse 13.1 • redhat enterprise linux desktop 6.0 • redhat enterprise linux eus 6.7 • redhat enterprise linux server 6.0 • redhat enterprise linux workstation 6.0

Related

Weakness · CWE (1)

  • CWE-125 Out-of-bounds Read weakness

References