The JSGenericLowering class in compiler/js-generic-lowering.cc in Google V8 as used in Google Chrome before 50.0.2661.94 mishandles comparison operators which allows remote attackers to obtain sensitive information via crafted JavaScript code.