CVE-2016-5198highunder attackCWE-787

CVE-2016-5198: high-severity vulnerability in Google Chrome prior to 54.0.2840.90 for Linux…

Published · Updated

Follow this CVE+ Monitor Chrome+ Monitor Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

63Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.8epss 34%
from disclosure to weapon
Published on NVDJan 19
CISA KEV+1966d
What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗
Fixed
3 products (12 components)
Red Hat Enterprise Linux Desktop Supplementary (v. 6) · Red Hat Enterprise Linux Server Supplementary (v. 6) · Red Hat Enterprise Linux Workstation Supplementary (v. 6)
fix ↗
Action required by CISAfederal deadline: 2022-06-22

Apply updates per vendor instructions.

In short

V8 (Chrome's JavaScript engine) had a flaw in its optimization logic that allowed attackers to read and write arbitrary memory through a malicious website, potentially leading to complete control of your browser.

Technical detail

V8's optimization assumptions were incorrect, allowing out-of-bounds memory access (CWE-787) via crafted JavaScript in a web page. This enabled arbitrary read/write operations in the renderer process, facilitating code execution with renderer privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumptions, which allowed a remote attacker to perform arbitrary read/write operations, leading to code execution, via a crafted HTML page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
n/a · Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac