Description
uri.js in Google V8 before 5.1.281.26, as used in Google Chrome before 51.0.2704.63, uses an incorrect array type, which allows remote attackers to obtain sensitive information by calling the decodeURI function and leveraging "type confusion."
Exploits (1)
github
NO CODE
31 stars
by OpenSISE · cpoc
https://github.com/OpenSISE/CVE_PoC_Collect/tree/master/Browser/CVE-2016-1677.html
References (12)
Scores
CVSS v3
6.5
EPSS
0.1263
EPSS Percentile
94.0%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Details
CWE
CWE-200
Status
published
Products (12)
canonical/ubuntu_linux
14.04
canonical/ubuntu_linux
15.10
canonical/ubuntu_linux
16.04
debian/debian_linux
8.0
google/chrome
< 50.0.2661.102
google/v8
< 5.1.281
opensuse/leap
42.1
opensuse/opensuse
13.2
redhat/enterprise_linux_desktop
6.0
redhat/enterprise_linux_server
6.0
... and 2 more
Published
Jun 05, 2016
Tracked Since
Feb 18, 2026