CVE-2016-5198: Google Chrome V8 out-of-bounds write enables code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS 8.8 with network reachability, no privileges required, and confirmed KEV listing with an exploit-tagged reference make this a high-priority patching item despite the required user interaction.

What it is

V8 in Google Chrome before 54.0.2840.90 (Linux), 54.0.2840.85 (Android), and 54.0.2840.87 (Windows/Mac) made incorrect optimisation assumptions, resulting in an out-of-bounds write (CWE-787). A crafted HTML page can trigger arbitrary read/write, which leads to code execution in the browser process. It matters because Chrome is widely deployed and the flaw is listed in CISA KEV.

Impact

An attacker gains arbitrary read/write within the affected process and can escalate that to code execution, giving control of the browser and potentially the underlying host depending on sandbox and OS state.

Attack surface

Reached remotely over the network by rendering a crafted HTML page; the CVSS vector shows no privileges required but user interaction required, so a victim must load the page. No authentication is needed.

Exploitation

CISA added it to KEV on 2022-06-08 with a 2022-06-22 due date, and the crbug.com reference is tagged Exploit; EPSS 30-day probability is 0.34164 (98.3rd percentile). No ransomware campaign use is documented.

What to do

• Upgrade Chrome to 54.0.2840.90 (Linux), 54.0.2840.85 (Android), or 54.0.2840.87 (Windows/Mac) or later, and apply the referenced Red Hat RHSA-2016-2672 errata for bundled Chromium packages.
• Enforce automatic browser updates and verify version compliance across managed endpoints.
• Restrict or isolate browsing of untrusted web content, for example via sandboxing or remote browsing, until all instances are patched.
• Track the KEV due date and confirm remediation of any remaining unpatched Chrome or Chromium installs.

Detection

• Inventory Chrome and Chromium versions across endpoints and alert on any build older than the fixed releases.
• Monitor for browser process crashes or memory corruption indicators in Chrome renderer logs that could reflect exploitation attempts.
• Hunt for Chrome spawning unexpected child processes or writing to unusual paths, which can indicate post-exploitation code execution.
• Review proxy and DNS logs for access to known exploit-hosting or malvertising domains tied to browser exploitation campaigns.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.