PT-2016-3053 · Google+5 · Google Chrome+5

Phil Oester · Published 2016-11-01 · Updated 2025-09-29 · CVE-2016-5198

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 54.0.2840.90 for Linux Google Chrome versions prior to 54.0.2840.85 for Android Google Chrome versions prior to 54.0.2840.87 for Windows and Mac

Description The issue is related to incorrect optimization assumptions in the V8 component of Google Chrome, which can be exploited by a remote attacker to perform arbitrary read/write operations, leading to code execution. This can be achieved via a crafted HTML page.

Recommendations For Google Chrome versions prior to 54.0.2840.90 for Linux, update to version 54.0.2840.90 or later. For Google Chrome versions prior to 54.0.2840.85 for Android, update to version 54.0.2840.85 or later. For Google Chrome versions prior to 54.0.2840.87 for Windows and Mac, update to version 54.0.2840.87 or later. As a temporary workaround, consider avoiding the use of specially crafted HTML pages until a patch is applied.

Exploit

Fix

Out of bounds Read

Memory Corruption

Weakness Enumeration

CWE-125

CWE-787

Related Identifiers

ALSA-2025_16880

ALT-PU-2016-2425

BDU:2017-00152

CVE-2016-5198

DSA-3731-1

MGASA-2016-0403

OPENSUSE-SU-2016:2732-1

OPENSUSE-SU-2016:2733-1

OPENSUSE-SU-2016_2733-1

OPENSUSE-SU-2024:10171-1

OPENSUSE-SU-2024:12948-1

RHSA-2016:2672

RHSA-2016_2672

USN-3133-1

Affected Products

Alt Linux

Google Chrome

Opera

Red Hat

Suse

Ubuntu

References · 2372

• 🔥 https://github.com/tunz/js-vuln-db/blob/master/v8/CVE-2016-5198.md · Exploit
• 🔥 https://crbug.com/659475 · Exploit
• https://osv.dev/vulnerability/openSUSE-SU-2024:12948-1 · Vendor Advisory
• https://chromereleases.googleblog.com/2016/11/stable-channel-update-for-desktop.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2016:2733-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2016-5198 · Security Note
• https://advisories.mageia.org/MGASA-2016-0403.html · Security Note
• https://osv.dev/vulnerability/USN-3133-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-5198 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2016-5198 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3133-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00152 · Security Note
• https://osv.dev/vulnerability/CVE-2016-5198 · Vendor Advisory
• https://ubuntu.com/security/CVE-2016-5202 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10171-1 · Vendor Advisory