CVE-2016-1586: Oxide Project Oxide

High severity, CVSS 7.5. EPSS: 0.7% chance of exploitation in the next 30 days.

A malicious webview could install long-lived unload handlers that re-use an incognito BrowserContext that is queued for destruction in versions of Oxide before 1.18.3.

Affected products

• Oxide Project Oxide: before 1.18.3 (fixed in 1.18.3)

Published 2019-04-22. Last modified 2026-06-17.