Medium
Security advisory
The regexp (aka regular expression) implementation in Google V8 before 5.0.71.40, as used in Google Chrome before 51.0.2704.63, mishandles external string sizes, which allows remote attackers to cause a denial of service (out-of-bounds read) via crafted JavaScript code.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-1688
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 04:57 UTC · Revision 1
Source evidence
The regexp (aka regular expression) implementation in Google V8 before 5.0.71.40, as used in Google Chrome before 51.0.2704.63, mishandles external string sizes, which allows remote attackers to cause a denial of service (out-of-bounds read) via crafted JavaScript code.
osv:CVE-2016-1688
Complete source record
{
"id": "4d227d47a98594d2b1b9bc15c2365d389afdd88ac4b7e83a352fbd59563f2f1c",
"url": "https://osv.dev/vulnerability/CVE-2016-1688",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-1688",
"summary": "The regexp (aka regular expression) implementation in Google V8 before 5.0.71.40, as used in Google Chrome before 51.0.2704.63, mishandles external string sizes, which allows remote attackers to cause a denial of service (out-of-bounds read) via crafted JavaScript code.",
"evidence": "osv:CVE-2016-1688",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2016-1688",
"aliases": [
"CVE-2016-1688"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/v8/v8",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "ad16e6c2cbd2c6b0f2e8ff944ac245561c682ac2"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:google:v8:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "5.0.71"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"5.0.71",
"3.29.86",
"3.29.85",
"3.29.80",
"3.29.79",
"3.29.77",
"3.29.76",
"3.29.73",
"3.29.72",
"3.29.71",
"3.29.69",
"3.29.68",
"3.29.67",
"3.29.65",
"3.29.63",
"3.29.62",
"3.29.61",
"3.29.60",
"3.29.58",
"3.29.56",
"3.29.55",
"3.29.54",
"3.29.52",
"3.29.51",
"3.29.49",
"3.29.48",
"3.29.47",
"3.29.46",
"3.29.45",
"3.29.44",
"3.29.42",
"3.29.39",
"3.29.37",
"3.29.36",
"3.29.34",
"3.29.33",
"3.29.32",
"3.29.31",
"3.29.30",
"3.29.28",
"3.29.26",
"3.29.22",
"3.29.21",
"3.29.19",
"3.29.18",
"3.29.15",
"3.29.13",
"3.29.12",
"3.29.8",
"3.29.7",
"3.29.6",
"3.29.5",
"3.29.4",
"3.29.3",
"3.29.2",
"3.29.1",
"3.28.72",
"3.28.70",
"3.28.68",
"3.28.67",
"3.28.66",
"3.28.63",
"3.28.61",
"3.28.58",
"3.28.56",
"3.28.55",
"3.28.49",
"3.28.47",
"3.28.46",
"3.28.44",
"3.28.42",
"3.28.41",
"3.28.40",
"3.28.39",
"3.28.37",
"3.28.36",
"3.28.34",
"3.28.33",
"3.26.30",
"3.21.18"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-1688.json"
}
}
],
"modified": "2026-10-24T10:30:23.420994050Z",
"provider": "osv",
"references": [
"https://codereview.chromium.org/1927003003",
"https://crbug.com/604897",
"https://access.redhat.com/errata/RHSA-2016:1190",
"https://security.gentoo.org/glsa/201607-07"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*"
],
"vendor_product": "google:chrome",
"extracted_events": [
{
"range": [
{
"last_affected": "50.0.2661.102"
}
],
"source": "CPE_RANGE"
}
]
},
{
"cpes": [
"cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:15.10:*:*:*:*:*:*:*",
"cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:lts:*:*:*"
],
"vendor_product": "canonical:ubuntu_linux",
"extracted_events": [
{
"range": [
{
"introduced": "14.04"
},
{
"last_affected": "14.04"
},
{
"introduced": "15.10"
},
{
"last_affected": "15.10"
},
{
"introduced": "16.04"
},
{
"last_affected": "16.04"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:opensuse:leap:42.1:*:*:*:*:*:*:*"
],
"vendor_product": "opensuse:leap",
"extracted_events": [
{
"range": [
{
"introduced": "42.1"
},
{
"last_affected": "42.1"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:opensuse:opensuse:13.2:*:*:*:*:*:*:*"
],
"vendor_product": "opensuse:opensuse",
"extracted_events": [
{
"range": [
{
"introduced": "13.2"
},
{
"last_affected": "13.2"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_desktop",
"extracted_events": [
{
"range": [
{
"introduced": "6.0"
},
{
"last_affected": "6.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_server",
"extracted_events": [
{
"range": [
{
"introduced": "6.0"
},
{
"last_affected": "6.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*"
],
"vendor_product": "redhat:enterprise_linux_workstation",
"extracted_events": [
{
"range": [
{
"introduced": "6.0"
},
{
"last_affected": "6.0"
}
],
"source": "CPE_STRING"
}
]
},
{
"cpes": [
"cpe:2.3:o:suse:linux_enterprise:12.0:*:*:*:*:*:*:*"
],
"vendor_product": "suse:linux_enterprise",
"extracted_events": [
{
"range": [
{
"introduced": "12.0"
},
{
"last_affected": "12.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2016-1688",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 430916,
"published_at": "2016-06-05T23:59:17.54+00:00"
}