Vulnerability record · CVE-2016-1646 · published 29 March 2016
CVE-2016-1646: Google Chrome V8 Array.concat out-of-bounds read
Debian · Debian Linux
The Array.prototype.concat implementation in Google V8 fails to properly consider element data types, causing an out-of-bounds read. It affects Google Chrome before 49.0.2623.108 and the V8 engine as shipped in multiple Linux distributions. The flaw matters because it is remotely reachable through crafted JavaScript and is listed in CISA's Known Exploited Vulnerabilities catalog.
Description
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automated analysis
high priorityIt is listed in CISA KEV with a very high EPSS score and a CVSS of 8.8, but exploitation requires user interaction and the affected Chrome version is long superseded.
What it is
The Array.prototype.concat implementation in Google V8 fails to properly consider element data types, causing an out-of-bounds read. It affects Google Chrome before 49.0.2623.108 and the V8 engine as shipped in multiple Linux distributions. The flaw matters because it is remotely reachable through crafted JavaScript and is listed in CISA's Known Exploited Vulnerabilities catalog.
Impact
An attacker can trigger an out-of-bounds read that crashes the browser (denial of service) and, per the record, may have unspecified further impact. The CVSS 3.1 vector rates confidentiality, integrity and availability all as high.
Attack surface
Reached over the network by getting a victim to load a page or content containing crafted JavaScript; the vector requires user interaction (UI:R) and no privileges (PR:N). No authentication is needed on the target side.
Exploitation
CVE-2016-1646 is in CISA KEV (added 2022-06-08, due 2022-06-22), indicating known exploitation in the wild, and EPSS is 0.4811 (98.8th percentile). A Chromium issue reference is tagged Exploit, and a Chromium code review reference is tagged Patch.
What to do
- Upgrade Google Chrome to 49.0.2623.108 or later, and apply the corresponding V8/Chromium updates from Debian, Ubuntu, Red Hat, SUSE/openSUSE and Gentoo advisories.
- Track the CISA KEV due date and confirm all browser and embedded-Chromium (Electron, CEF) instances are updated, not just the primary browser.
- Where immediate patching is not possible, restrict browsing to trusted sites and reduce exposure to untrusted JavaScript; note this is a stopgap, not a fix.
- Inventory systems running affected Linux distributions and verify the vendor errata (RHSA-2016-0525, DSA-3531, USN-2955-1, openSUSE and Gentoo advisories) have been applied.
Detection
- Monitor for Chrome/Chromium renderer crashes and abnormal process termination that correlate with visits to untrusted or newly seen domains.
- Hunt proxy, DNS and browser telemetry for requests to sites delivering obfuscated or exploit-like JavaScript to unpatched Chrome versions.
- Check endpoint software inventory for Chrome builds older than 49.0.2623.108 and for embedded Chromium frameworks that may lag behind.
- Review vendor patch status reports against the KEV due date to confirm remediation coverage.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2016-1646 to the Known Exploited Vulnerabilities catalog on 8 June 2022 as "Google Chromium V8 Out-of-Bounds Read Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 22 June 2022.
Affected products
10 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2016-1646 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2016-1646), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
