CVE-2016-5198
Google Chromium V8 Engine contains an out-of-bounds memory access vulnerability that allows a remote attacker to perform read/write operations, leading to code execution, via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumptions, which allowed a remote attacker to perform arbitrary read/write operations, leading to code execution, via a crafted HTML page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H- rhn.redhat.com/errata/RHSA-2016-2672.htmlThird Party Advisory
- securityfocus.com/bid/94079Broken LinkThird Party Advisory
- securitytracker.com/id/1037224Broken LinkThird Party Advisory
- chromereleases.googleblog.com/2016/11/stable-channel-update-for-desktop.htmlRelease NotesVendor Advisory
- crbug.com/659475ExploitIssue Tracking
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-5198US Government Resource
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1588 days
- CVSS
- 8.8 HIGH
- EPSS (30-day exploit probability)
- 34.2% · top 2% of all CVEs
- Weakness
- CWE-787
- Attack vector
- Network, remotely reachable
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.