CVE-2016-1646

debian linux, canonical ubuntu linux, google chrome

Published 29 Mar 2016 · updated 17 Jun 2026 · Analyzed

8.8 High · CVSS 3.1, NVD

Exploited in the wild

CISA added this to its Known Exploited Vulnerabilities catalog on 8 Jun 2022, with a remediation deadline of 22 Jun 2022 for US federal agencies.

Required action: Apply updates per vendor instructions.

Description

The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.

References

googlechromereleases.blogspot.com/2016/03/stable-channel-update_24.html · Release Notes, Vendor Advisory
lists.opensuse.org/opensuse-security-announce/2016-04/msg00000.html · Mailing List, Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-04/msg00001.html · Mailing List, Third Party Advisory
lists.opensuse.org/opensuse-security-announce/2016-04/msg00039.html · Mailing List, Third Party Advisory
rhn.redhat.com/errata/RHSA-2016-0525.html · Third Party Advisory
www.debian.org/security/2016/dsa-3531 · Mailing List, Third Party Advisory
www.securitytracker.com/id/1035423 · Broken Link, Third Party Advisory, VDB Entry
www.ubuntu.com/usn/USN-2955-1 · Third Party Advisory
code.google.com/p/chromium/issues/detail?id=594574 · Exploit, Issue Tracking, Mailing List
codereview.chromium.org/1804963002/ · Patch
security.gentoo.org/glsa/201605-02 · Third Party Advisory
www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-1646 · US Government Resource