CVE-2016-5198KEV · OVERDUE

Google Chromium V8 Out-of-Bounds Memory Vulnerability

High · published January 19, 2017

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 98.4th percentile for exploit probability.

1583
days past CISA
deadline
CVSS v3.1
8.8
EPSS
34%
Percentile
98.4
In the wild
Confirmed
What it is

🚨 A crafty HTML page can flip your browser into a playground for attackers! 🔥 This vulnerability in Google Chrome lets them perform arbitrary read/write operations, leading straight to code execution. Think of this as a restaurant where a diner can not only order meals but also sneak into the kitchen to cook their own dishes. That’s exactly how this flaw allows malicious actors to manipulate browser memory and execute their own code without permission! An attacker could exploit this vulnerability to execute arbitrary code on your system, potentially leading to data theft, system compromise, or other devastating consequences. Imagine a hacker with full access to your files and the ability to manipulate your system like a puppet — absolutely alarming!

Put simply

Think of this as a restaurant where a diner can not only order meals but also sneak into the kitchen to cook their own dishes. That’s exactly how this flaw allows malicious actors to manipulate browser memory and execute their own code without permission! This vulnerability arises from incorrect optimization assumptions in V8, Chrome's JavaScript engine, allowing attackers to exploit crafted HTML pages to perform malicious read/write operations.

What to do

An attacker could exploit this vulnerability to execute arbitrary code on your system, potentially leading to data theft, system compromise, or other devastating consequences. Imagine a hacker with full access to your files and the ability to manipulate your system like a puppet — absolutely alarming! To protect yourself, update Google Chrome immediately to versions 54.0.2840.90 for Linux, 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac. Keeping your browser up-to-date is your first line of defense against these sneaky attacks! You've got this! Stay ahead of the game with these updates, and you'll be surfing the web securely in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.34164 · 98.4th percentile
Published
2017-01-19T05:43Z
KEV added
2022-06-08 · due 2022-06-22
EPSS history
Timeline
  • 08 JUN 00:00Z
    Added to CISA KEV — remediate by Jun 22
    kev
  • 19 JAN 05:43Z
    V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation…
    cvelistv5