⚠ Actively exploited
Added to CISA KEV on 2022-06-08. Federal agencies required to patch by 2022-06-22. Required action: Apply updates per vendor instructions..
CVE-2016-1646 — Out-of-bounds Read in Google Chrome
Severity
8.8HIGHNVD
OSV9.8
EPSS
66.5%
top 1.46%
CISA KEV
KEV
Added 2022-06-08
Due 2022-06-22
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedMar 29
KEV addedJun 8
KEV dueJun 22
Latest updateDec 5
CISA Required Action: Apply updates per vendor instructions.
Description
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9
Affected Packages6 packages
Also affects: Debian Linux 8.0, 9.0, Ubuntu Linux 14.04, 15.10, 16.04, Enterprise Linux 6.7
Patches
🔴Vulnerability Details
5📋Vendor Advisories
3🕵️Threat Intelligence
5Trendmicro▶
MOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur’s Multi-Platform Attacks↗2024-12-05
Trendmicro▶
MOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur’s Multi-Platform Attacks↗2024-12-05
Trendmicro▶
MOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur’s Multi-Platform Attacks↗2024-12-05
Trendmicro▶
MOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur’s Multi-Platform Attacks↗2024-12-05
Trendmicro▶
MOONSHINE Exploit Kit and DarkNimbus Backdoor Enabling Earth Minotaur’s Multi-Platform Attacks↗2024-12-05