Skip to content
← Browse CVEs

CVE-2016-1646

High · CVSS 8.8EPSS 45.3%CISA KEVCWE-125 · Out-of-bounds Read

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.

References

NVD MITRE CVE.org CISA KEV

Published

Community ground truth

Community verdict

3 verdicts
Not a real issue

to add your verdict.

Community real-world severity: High (High 3) — CVSS base score 8.8

In line with its CVSS base score.

Field notes & remediation

Verdicts are the quick signal — notes are the evidence and fixes behind them.

No notes yet — be the first to share what you saw or a fix that worked.

    Related CVEs

    Same weakness — CWE-125 · Out-of-bounds Read.