Google · Chromium V8
CVE-2016-1646
Google Chromium V8 Out-of-Bounds Read Vulnerability
Nedir
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.
CISA: Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Ne yapmalı
Apply updates per vendor instructions.
ABD federal kurumları için son tarih: 22 Haziran 2022
- CISA listesine eklenme
- 8 Haziran 2022
- Yayımlanma
- 29 Mart 2016
- Önem
- Yüksek 8,8 CVSS 3.1
- Önümüzdeki 30 günde saldırı olasılığı (EPSS)
- 48% bilinen tüm açıkların en üstteki 1,1% diliminde
- Zayıflık
- CWE-119
- Daha fazla ayrıntı
- NVD · CVE.org · CISA
Tüm kaynaklar (11)
- http://rhn.redhat.com/errata/RHSA-2016-0525.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00039.html
- http://www.debian.org/security/2016/dsa-3531
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00001.html
- http://www.ubuntu.com/usn/USN-2955-1
- https://security.gentoo.org/glsa/201605-02
- http://googlechromereleases.blogspot.com/2016/03/stable-channel-update_24.html
- https://codereview.chromium.org/1804963002/
- http://www.securitytracker.com/id/1035423
- https://code.google.com/p/chromium/issues/detail?id=594574
Google için istismar edilen diğer açıklar
| Eklenme | Açık | Ürün | Önem | Saldırı olasılığı |
|---|---|---|---|---|
| 9 Eyl 2026 | Out of Bounds Write | Chromium V8 | Yüksek 8,8 | 3,5% |
| 4 Eyl 2026 | Type Confusion | Chromium V8 | Yüksek 8,8 | 1,8% |
| 9 Haz 2026 | Out-of-Bounds Read and Write | Chromium V8 | Yüksek 8,8 | 2,4% |
| 13 Mar 2026 | Improper Restriction of Operations Within the Bounds of a Memory Buffer | Chromium V8 | Yüksek 8,8 | 2,7% |
| 19 Kas 2025 | Type Confusion | Chromium V8 | Yüksek 8,8 | 4,9% |
| 23 Eyl 2025 | Type Confusion | Chromium V8 | Yüksek 8,8 | 9,0% |
| 2 Tem 2025 | Type Confusion | Chromium V8 | Yüksek 8,1 | 14% |
| 5 Haz 2025 | Out-of-Bounds Read and Write | Chromium V8 | Yüksek 8,8 | 7,8% |
Kaynaklar: Known Exploited Vulnerabilities (CISA, kamu malı), CVE records (cve.org) ve EPSS (FIRST). Saldırı olasılığı, birinin önümüzdeki 30 günde açığı istismar etmeye çalışacağına dair EPSS tahminidir.