cyfenced.com →

[ CVE-2016-1646 · Published 29 Mar 2016 ]

Google Chromium V8 Out-of-Bounds Read Vulnerability

Exploited · CISA KEV CVSS 8.8 EPSS 48%Fix available

[ Why it matters ]Priority signals

  • Exploited in the wild: on CISA's Known Exploited Vulnerabilities list since 2022-06-08
  • EPSS: 48% chance of exploitation in the next 30 days (higher than 99% of CVEs)

[ Description ]Official description

The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.

CISA: Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

[ Fixes ]Fixes and patches

CISA required action (US federal deadline 22 Jun 2022): Apply updates per vendor instructions.

[ References ]References