CVE-2016-5198

V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumptions, which allowed a remote attacker to perform arbitrary read/write operations, leading to code execution, via a crafted HTML page.

• CWE-787
• CWE-787

• http://rhn.redhat.com/errata/RHSA-2016-2672.htmlThird Party Advisory
• http://www.securityfocus.com/bid/94079Broken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037224Broken Link, Third Party Advisory, VDB Entry
• https://chromereleases.googleblog.com/2016/11/stable-channel-update-for-desktop.htmlRelease Notes, Vendor Advisory
• https://crbug.com/659475Exploit, Issue Tracking
• http://rhn.redhat.com/errata/RHSA-2016-2672.htmlThird Party Advisory
• http://www.securityfocus.com/bid/94079Broken Link, Third Party Advisory, VDB Entry
• http://www.securitytracker.com/id/1037224Broken Link, Third Party Advisory, VDB Entry
• https://chromereleases.googleblog.com/2016/11/stable-channel-update-for-desktop.htmlRelease Notes, Vendor Advisory
• https://crbug.com/659475Exploit, Issue Tracking
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-5198US Government Resource

Published

Jan 19, 2017

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-5192Blink in Google Chrome prior to 54.0.2840.59 for Windows mis…
• CVE-2016-5193Google Chrome prior to 54.0 for iOS had insufficient validat…
• CVE-2016-5194Unspecified vulnerabilities in Google Chrome before 54.0.284…9.8
• CVE-2016-5195Race condition in mm/gup.c in the Linux kernel 2.x through 4…7
• CVE-2016-5196The content renderer client in Google Chrome prior to 54.0.2…
• CVE-2016-5197The content view client in Google Chrome prior to 54.0.2840.…
• CVE-2016-5199An off by one error resulting in an allocation of zero size …
• CVE-2016-5200V8 in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.…
• CVE-2016-5201A leak of privateClass in the extensions API in Google Chrom…
• CVE-2016-5202browser/extensions/api/dial/dial_registry.cc in Google Chrom…9.1
• CVE-2016-5203A use after free in PDFium in Google Chrome prior to 55.0.28…
• CVE-2016-5204Leaking of an SVG shadow tree leading to corruption of the D…