AUGUST 4, 2026
Live Feed
Back to database
Case File

CVE-2016-1636

CRITICAL · CVSS 9.8 EPSS 1.84%

Source: NVD + CISA KEV + EPSS (historical backfill) · Published 2016-03-06 · Last synced 2026-08-04

CyberRota Analysis

This is a critical severity vulnerability with a CVSS score of 9.8. It affects Chrome. It may be remotely exploitable.

CVE
CVE-2016-1636
Severity
CRITICAL
CVSS
9.8
EPSS
1.84%
Chrome

Original NVD Description

The PendingScript::notifyFinished function in WebKit/Source/core/dom/PendingScript.cpp in Google Chrome before 49.0.2623.75 relies on memory-cache information about integrity-check occurrences instead of integrity-check successes, which allows remote attackers to bypass the Subresource Integrity (aka SRI) protection mechanism by triggering two loads of the same resource.