---
id: "CVE-2016-1646"
kind: "vulnerability"
aliases: ["CVE-2016-1646"]
title: "The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before\u2026"
severity: "critical"
cvss: 9.3
epss: 0.4811
exploited: true
status: "open"
category: "runtime"
products: [{"name": "Google Chromium V8", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 8.0", "ecosystem": "vendor"}, {"name": "debian linux", "fixed": [], "affected": "= 9.0", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": [], "affected": "= 14.04", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": [], "affected": "= 15.10", "ecosystem": "vendor"}, {"name": "canonical ubuntu linux", "fixed": [], "affected": "= 16.04", "ecosystem": "vendor"}, {"name": "google chrome", "fixed": ["49.0.2623.108"], "affected": "< 49.0.2623.108", "ecosystem": "vendor"}, {"name": "suse package hub", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "opensuse leap", "fixed": [], "affected": "= 42.1", "ecosystem": "vendor"}, {"name": "opensuse", "fixed": [], "affected": "= 13.1", "ecosystem": "vendor"}, {"name": "redhat enterprise linux desktop", "fixed": [], "affected": "= 6.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux eus", "fixed": [], "affected": "= 6.7", "ecosystem": "vendor"}, {"name": "redhat enterprise linux server", "fixed": [], "affected": "= 6.0", "ecosystem": "vendor"}, {"name": "redhat enterprise linux workstation", "fixed": [], "affected": "= 6.0", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["browsers", "chromium", "exploited", "google-chrome", "microsoft-edge", "opera", "runtime"]
not_affected_if: ["fully-patched-browsers", "js-disabled"]
published_at: "2016-03-29T10:59:00+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T22:29:04+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-1646", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2016-1646", "first_seen_at": "2026-10-23T19:13:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-1646", "first_seen_at": "2026-10-23T22:29:04+00:00"}]
---

# The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before…

The V8 JavaScript engine in Chromium-based browsers has an out-of-bounds read that a crafted web page can trigger. An attacker can crash the browser or possibly achieve other unspecified impact, and it is listed as exploited in the wild.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Google Chromium V8 affected ? fixed ?
- vendor:debian linux affected = 8.0 fixed ?
- vendor:debian linux affected = 9.0 fixed ?
- vendor:canonical ubuntu linux affected = 14.04 fixed ?
- vendor:canonical ubuntu linux affected = 15.10 fixed ?
- vendor:canonical ubuntu linux affected = 16.04 fixed ?
- vendor:google chrome affected < 49.0.2623.108 fixed 49.0.2623.108
- vendor:suse package hub affected ? fixed ?
- vendor:opensuse leap affected = 42.1 fixed ?
- vendor:opensuse affected = 13.1 fixed ?
- vendor:redhat enterprise linux desktop affected = 6.0 fixed ?
- vendor:redhat enterprise linux eus affected = 6.7 fixed ?
- vendor:redhat enterprise linux server affected = 6.0 fixed ?
- vendor:redhat enterprise linux workstation affected = 6.0 fixed ?

## Fix

Update Chrome, Edge, Opera and other Chromium-based browsers to a release that includes the vendor fix; the sources do not give the fixed version.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2016-1646
- 2026-10-23T19:13:45+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2016-1646
- 2026-10-23T22:29:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2016-1646

## From the sources

Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_