CVE-2016-5198

CVE-2016-5198 is an out-of-bounds memory access (out-of-bounds read/write, CWE-125/CWE-787) in the V8 JavaScript engine used by Google Chromium. An attacker triggers it by inducing a user to open a crafted HTML page in a vulnerable Chromium-based browser, causing the engine to read or write outside allocated memory. Successful exploitation allows a remote attacker to gain read/write primitives that can escalate to code execution in the browser context. Anyone using a browser or application built on the affected Chromium V8 engine is exposed, including Google Chrome, Microsoft Edge, Opera, and other Chromium derivatives per CISA's description. The flaw is listed in the CISA KEV (added 2022-06-08), indicating known exploitation in the wild, though no public proof-of-concept is known, ransomware association is unknown, and CVSS has not been scored; EPSS estimates a 34.8% probability of exploitation within 30 days (98th percentile).

What to do: Apply vendor-supplied updates for all Chromium-based browsers (Chrome, Edge, Opera) and any Chromium-embedded applications per vendor instructions, as CISA's required action specifies; verify browser versions via each product's About/settings page and prioritize endpoints used to browse untrusted content. The KEV listing confirms active exploitation, so treat patching as urgent; note that specific fixed version numbers are not provided in the source data and ransomware linkage is unknown.