Login Sign Up

CVE-2016-1662

9.8 CRITICAL
Denial of Service

📋 TL;DR

This vulnerability in Google Chrome's extensions renderer allows remote attackers to trigger a use-after-free condition via garbage collection callback issues. It could lead to denial of service or potentially arbitrary code execution. All users running affected Chrome versions are at risk.

💻 Affected Systems

Products:
  • Google Chrome
Versions: All versions before 50.0.2661.94
Operating Systems: Windows, macOS, Linux, Chrome OS
Default Config Vulnerable: ⚠️ Yes
Notes: Affects all Chrome installations regardless of extensions or settings. Chrome extensions renderer component is vulnerable.

📦 What is this software?

Chrome by Google

Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...

Learn more about Chrome →

Enterprise Linux Desktop Supplementary by Redhat

View all CVEs affecting Enterprise Linux Desktop Supplementary →

Enterprise Linux Server Supplementary by Redhat

View all CVEs affecting Enterprise Linux Server Supplementary →

Enterprise Linux Server Supplementary Eus by Redhat

View all CVEs affecting Enterprise Linux Server Supplementary Eus →

Enterprise Linux Workstation Supplementary by Redhat

View all CVEs affecting Enterprise Linux Workstation Supplementary →

Opensuse by Opensuse

View all CVEs affecting Opensuse →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Remote code execution leading to complete system compromise, data theft, or persistent malware installation.

🟠

Likely Case

Browser crash/denial of service, potentially allowing sandbox escape and limited code execution within browser context.

🟢

If Mitigated

Browser crash with no further impact if sandboxing holds, though memory corruption could still be leveraged.

🌐 Internet-Facing: HIGH - Exploitable via malicious websites or ads without user interaction.
🏢 Internal Only: MEDIUM - Requires user to visit malicious content, but internal phishing or compromised sites could trigger it.

🎯 Exploit Status

Public PoC: ✅ No
Weaponized: UNKNOWN
Unauthenticated Exploit: ⚠️ Yes
Complexity: MEDIUM

Requires memory corruption exploitation skills but no authentication. Unknown if actively exploited in wild.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: 50.0.2661.94 and later

Vendor Advisory: http://googlechromereleases.blogspot.com/2016/04/stable-channel-update_28.html

Restart Required: Yes

Instructions:

1. Open Chrome browser. 2. Click menu (three dots) → Help → About Google Chrome. 3. Browser will automatically check for and install update. 4. Click 'Relaunch' to restart Chrome with updated version.

🔧 Temporary Workarounds

Disable JavaScript

all

Temporarily disable JavaScript to prevent exploitation vectors, though this breaks most websites.

chrome://settings/content/javascript → toggle to 'Blocked'

Use Chrome Sandbox

all

Ensure Chrome sandbox is enabled (default) to contain potential exploitation.

Verify via chrome://sandbox/

🧯 If You Can't Patch

  • Use alternative browser until Chrome can be updated.
  • Implement network filtering to block known malicious sites and ads.

🔍 How to Verify

Check if Vulnerable:

Check Chrome version via chrome://version/ or 'About Google Chrome' in menu. If version is below 50.0.2661.94, system is vulnerable.

Check Version:

chrome://version/ or 'google-chrome --version' on command line

Verify Fix Applied:

Confirm Chrome version is 50.0.2661.94 or higher via chrome://version/.

📡 Detection & Monitoring

Log Indicators:

  • Chrome crash reports, abnormal process termination, memory access violation logs

Network Indicators:

  • Unusual outbound connections from Chrome process post-crash

SIEM Query:

source="chrome_crash_reports" AND (event_id="1000" OR event_id="1001") AND process_name="chrome.exe"

📊 Metadata

CVE ID: CVE-2016-1662
CVSS v3 Score: 9.8 (CRITICAL)
CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published: May 14, 2016
Last Updated: April 12, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON