Skip to content
Fencer Vulns
high 8.8

CVE-2016-1646 kev in the critical feed json

The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly con…

published 2016-03-29 10 y ago modified 2026-06-17 4 mo ago also EUVD-2016-2741

cvss
8.8
version 3.1, CNA
cisa kev
Exploited
added 2022-06-08
epss
48.1%
EPSS 48.1% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • google chrome 49.0.2623.108
  • oxide-qt Ubuntu 14.04 LTS 1.14.7-0ubuntu0.14.04.1
  • oxide-qt Ubuntu 16.04 LTS 1.14.7-0ubuntu1
  • chromium-browser Ubuntu 14.04 LTS 49.0.2623.108-0ubuntu0.14.04.1.1113
  • chromium-browser Ubuntu 16.04 LTS 49.0.2623.108-0ubuntu1.1233

ubuntu advisories UBUNTU-CVE-2016-1646

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • chromium-browser RHEL 6 EXTRAS 49.0.2623.108-1.el6

red hat advisories RHSA-2016:0525

  • chromium openSUSE Tumbleweed 55.0.2883.75-3.1
  • chromium openSUSE Tumbleweed 113.0.5672.92-1.1

opensuse advisories openSUSE-SU-2024:10171-1openSUSE-SU-2024:12948-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2016-1646 updated cvss 6.8

chromium-browser: out-of-bounds read in V8

  • Red Hat Enterprise Linux Desktop Supplementary (v. 6) chromium-browser 49.0.2623.108-1.el6 Red Hat Enterprise Linux Server Supplementary (v. 6) chromium-browser 49.0.2623.108-1.el6 Red Hat Enterprise Linux Workstation Supplementary (v. 6) chromium-browser 49.0.2623.108-1.el6
    fixed: vendor fix RHSA-2016:0525

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. Published
  2. Added to CISA KEV
  3. CISA patch deadline
  4. CISA SSVC: exploitation active

Known exploited

Added
4 y ago
Patch by
2022-06-22 (4 y ago)
Ransomware
Not known
Required action
Apply updates per vendor instructions.
Vendor, product
Google, Chromium V8
CISA name
Google Chromium V8 Out-of-Bounds Read Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
no
Technical impact
total
Assessed
21 mo ago

Exploit prediction

48.11% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • code.google.com https://code.google.com/p/chromium/issues/detail?id=594574 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 9.3 AV:N/AC:M/Au:N/C:C/I:C/A:C

Classification

Weakness
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.