CVE-2016-5198: Google Chromium V8 Out-of-Bounds Memory Vulnerability
Vulnerability summary
CVE-2016-5198 is a high (CVSS 8.8) Out-of-bounds Write vulnerability in Google Chromium V8. It is known to be exploited: CISA lists it, first on 08-06-2022. EPSS estimates a 34.16% chance of exploitation in the next 30 days, higher than 98.3% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 5 · Related 3Timeline
- 19-01-2017PublishedVulnerability first disclosed.
- 08-06-2022Added to CISA KEVGoogle Chromium V8 Out-of-Bounds Memory Vulnerability
- 22-06-2022CISA remediation dueApply updates per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumptions, which allowed a remote attacker to perform arbitrary read/write operations, leading to code execution, via a crafted HTML page.
CVSS metrics
6 scores · 4 sources · 3 versions- NVDNIST8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- OSV · UbuntuEcosystem advisory · calculated8.8HighCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS trend
Probability
34.16%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 34.16% on 19-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 08-06-2022
- Federal due date
- 22-06-2022
CISA required action
Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2016-5198
Public exploits
1 foundExploit Reference (crbug.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Redhat5 products
- enterprise_linux_desktop6.0
- enterprise_linux_server6.0
- enterprise_linux_workstation6.0
- chromium-browser< 0:54.0.2840.90-1.el6
- chromium-browser-debuginfo< 0:54.0.2840.90-1.el6
Ubuntu3 products
- chromium-browser< 58.0.3029.81-0ubuntu0.14.04.1172 | < 55.0.2883.87-0ubuntu0.16.04.1263
- libv8-3.14All versions (No fix recorded)
- oxide-qt< 1.18.5-0ubuntu0.14.04.1 | < 1.18.5-0ubuntu0.16.04.1
Google1 product
- chrome< 54.0.2840.90 | < 54.0.2840.85 | < 54.0.2840.87
Suse1 product
- chromium&distro=SUSE Package Hub 12< 54.0.2840.90-112.1
4 vendors · 10 products
References
21 links- chromereleases.googleblog.com/2016/11/stable-channel-update-for-desktop.htmlX Refsource CONFIRMRelease NotesVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-5198Government ResourceUS Government Resource
- lists.opensuse.org/archives/…Advisory
- lists.opensuse.org/archives/…Advisory
