CVE-2016-1677

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

3.09%

Published

Jun 5, 2016

Modified

May 6, 2026

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

uri.js in Google V8 before 5.1.281.26, as used in Google Chrome before 51.0.2704.63, uses an incorrect array type, which allows remote attackers to obtain sensitive information by calling the decodeURI function and leveraging "type confusion."

Weaknesses (CWE)

CWE-200

Affected Products (12)

google · chromevulnerable

canonical · ubuntu_linuxvulnerable

debian · debian_linuxvulnerable

opensuse · leapvulnerable

opensuse · opensusevulnerable

redhat · enterprise_linux_desktopvulnerable

redhat · enterprise_linux_servervulnerable

redhat · enterprise_linux_workstationvulnerable

suse · linux_enterprisevulnerable

google · v8vulnerable

References (20)

http://googlechromereleases.blogspot.com/2016/05/stable-channel-update_25.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00062.html

http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00063.html

http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00005.html

http://www.debian.org/security/2016/dsa-3590

http://www.securityfocus.com/bid/90876

http://www.securitytracker.com/id/1035981

http://www.ubuntu.com/usn/USN-2992-1

https://access.redhat.com/errata/RHSA-2016:1190

https://codereview.chromium.org/1936083002

https://crbug.com/602970

https://security.gentoo.org/glsa/201607-07