VULNERABILITY INTELLIGENCE

CVE-2016-1646

CVSS score8.8 HIGH

EPSS probability48.11%

CISA KEVKnown exploited vulnerability

Published2016-03-29

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Known Exploited Vulnerability

Google Chromium V8 Out-of-Bounds Read Vulnerability

Vendor / product: Google / Chromium V8

Description

The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.

Weakness classification

CWE-125: Out-of-bounds Read

Primary references

chrome-cve-admin@google.com — Release Notes, Vendor Advisory
chrome-cve-admin@google.com — Mailing List, Third Party Advisory
chrome-cve-admin@google.com — Mailing List, Third Party Advisory
chrome-cve-admin@google.com — Mailing List, Third Party Advisory
chrome-cve-admin@google.com — Third Party Advisory
chrome-cve-admin@google.com — Mailing List, Third Party Advisory
chrome-cve-admin@google.com — Broken Link, Third Party Advisory, VDB Entry
chrome-cve-admin@google.com — Third Party Advisory
chrome-cve-admin@google.com — Exploit, Issue Tracking, Mailing List
chrome-cve-admin@google.com — Patch
chrome-cve-admin@google.com — Third Party Advisory
af854a3a-2127-422b-91ae-364da2661108 — Release Notes, Vendor Advisory