CVE-2016-5198 V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumptions, which allowed a remote attacker to....
HighCVSS 8.8
EPSS 34.2%
CISA KEV
added 2022-06-08 · due 2022-06-22
Exploited in the wild
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumptions, which allowed a remote attacker to perform arbitrary read/write operations, leading to code execution, via a crafted HTML page.
CISA Known Exploited Vulnerability
- Date added
- 2022-06-08
- Due date (FCEB)
- 2022-06-22
- Ransomware use
- Unknown
Required action
Apply updates per vendor instructions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Google Chrome | < 54.0.2840.90 | 54.0.2840.90 |
| Google Chrome | < 54.0.2840.85 | 54.0.2840.85 |
| Google Chrome | < 54.0.2840.87 | 54.0.2840.87 |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 6.0 | No fix listed |
References
- RHSA-2016:2672 third-party-advisory vendor-advisory
- 94079 broken-link third-party-advisory vdb-entry
- 1037224 broken-link third-party-advisory vdb-entry
- chromereleases.googleblog.com release-notes vendor-advisory
- crbug.com exploit issue-tracking
- www.cisa.gov government-resource us-government-resource