IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key
8.8High KEV

CVE-2016-5198Google Chromium V8 Out-of-Bounds Memory Vulnerability

Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac Published: (9 years ago)

Known exploited — Google Chromium V8 Out-of-Bounds Memory Vulnerability

CISA confirmed this vulnerability is used in real attacks on 08.06.2022. Remediation deadline for US federal agencies: 22.06.2022.

Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2016-5198

Description

V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumptions, which allowed a remote attacker to perform arbitrary read/write operations, leading to code execution, via a crafted HTML page.

Weakness (CWE): CWE-787

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

VendorProductVersions
google chrome < 54.0.2840.90
redhat enterprise linux desktop 6.0
redhat enterprise linux server 6.0
redhat enterprise linux workstation 6.0
— Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac

References and patches

CPE matches (NVD) (6)
  • cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* < 54.0.2840.90
  • cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* < 54.0.2840.85
  • cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* < 54.0.2840.87
  • cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
  • cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*

Recent CVEs in the same product — Google Chrome

5.4Medium
CVE-2026-120930
Google Chrome

Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

9.6Critical
CVE-2026-120931
Google Chrome

Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

5.4Medium
CVE-2026-121141
Google Chrome

Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

8.8High
CVE-2026-121195
Google Chrome

Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

7.8High
CVE-2026-121064
Google Chrome

Improper input validation in Performance in Google Chrome prior to 157.0.8103.38 allowed a local attacker to potentially execute arbitrary code inside the sandbox via a local program. (Chromium security severity: Low)

8.8High
CVE-2026-121069
Google Chrome

Use after free in Track in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Low)