Google V8 as used in Google Chrome before 34.0.1847.116 does not properly use numeric casts during handling of typed arrays which allows remote attackers to cause a denial of service (out-of-bounds array access) or possibly have unspecified other impact via crafted JavaScript code.