Exploitation Summary
CVE-2016-1646 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added June 8, 2022.
Description
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.
References (12)
Core 12
Core References
Third Party Advisory vendor-advisory
x_refsource_redhat
http://rhn.redhat.com/errata/RHSA-2016-0525.html
Mailing List, Third Party Advisory vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00000.html
Mailing List, Third Party Advisory vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00039.html
Release Notes, Vendor Advisory x_refsource_confirm
http://googlechromereleases.blogspot.com/2016/03/stable-channel-update_24.html
Mailing List, Third Party Advisory vendor-advisory
x_refsource_debian
http://www.debian.org/security/2016/dsa-3531
Patch x_refsource_confirm
https://codereview.chromium.org/1804963002/
Broken Link, Third Party Advisory, VDB Entry vdb-entry
x_refsource_sectrack
http://www.securitytracker.com/id/1035423
Mailing List, Third Party Advisory vendor-advisory
x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00001.html
Exploit, Issue Tracking, Mailing List x_refsource_confirm
https://code.google.com/p/chromium/issues/detail?id=594574
Third Party Advisory vendor-advisory
x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-2955-1
Third Party Advisory vendor-advisory
x_refsource_gentoo
https://security.gentoo.org/glsa/201605-02
Third Party Advisory, US Government Resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-1646
Scores
CVSS v3
8.8
EPSS
0.6691
EPSS Percentile
98.6%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
active
Automatable
no
Technical Impact
total
Details
CISA KEV
2022-06-08
VulnCheck KEV
2019-09-24
InTheWild.io
2020-03-25
ENISA EUVD
EUVD-2016-2741
CWE
CWE-125
Status
published
Products (13)
canonical/ubuntu_linux
14.04
canonical/ubuntu_linux
15.10
canonical/ubuntu_linux
16.04
debian/debian_linux
8.0
debian/debian_linux
9.0
google/chrome
< 49.0.2623.108
opensuse/leap
42.1
opensuse/opensuse
13.1
redhat/enterprise_linux_desktop
6.0
redhat/enterprise_linux_eus
6.7
... and 3 more
Published
Mar 29, 2016
KEV Added
Jun 08, 2022
Tracked Since
Feb 18, 2026