CVE-2016-1646
Google Chromium V8 Out-of-Bounds Read Vulnerability
Published Mar 29, 2016 · updated Jun 16, 2026 · debian debian linux
Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Timeline
Detection, updates, and resolution for this record.
Mar 29, 2016 · Catalog
Detected
Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Jun 8, 2022 · CISA KEV
Known exploited
Apply updates per vendor instructions.
Jun 22, 2022 · CISA KEV
Remediation due
Apply updates per vendor instructions.
Jun 16, 2026 · Catalog
Updated
Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Required action
Apply updates per vendor instructions.
CISA due date Jun 22, 2022
Affected
- cpe canonical/ubuntu linux14.04
- cpe canonical/ubuntu linux15.10
- cpe canonical/ubuntu linux16.04
- cpe debian/debian linux8.0
- cpe debian/debian linux9.0
- cpe google/chromeversion unspecified
- cpe opensuse/leap42.1
- cpe redhat/enterprise linux desktop6.0
- cpe suse/package hubversion unspecified
- vendor Google Chromium V8version unspecified
Sources
- CISA KEVCVE-2016-1646
Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
cisa.gov - CVE.orgCVE-2016-1646
Official CVE identifier
cve.org - FIRST EPSSCVE-2016-1646
30-day exploitation probability 48.1%
first.org - NIST NVDCVE-2016-1646
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other
nvd.nist.gov