CVE-2020-16004: Use after free in user interface
Published Oct 15, 2020
·Updated
Use after free in user interface in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Credit
Leecraso(360 Alpha Lab working with 360 BugCloud), Guang Gong(360 Alpha Lab working with 360 BugCloud)
Affected Software
10 affected componentsFixes available
debian/chromium
90.0.4430.212-1~deb10u1116.0.5845.180-1~deb11u1120.0.6099.129-1~deb11u1119.0.6045.199-1~deb12u1120.0.6099.129-1~deb12u1120.0.6099.129-1
Google Chrome<86.0.4240.183
86.0.4240.183
Google Chrome<86.0.4240.183
openSUSE Backports SLE=15.0-sp1
openSUSE Backports SLE=15.0-sp2
openSUSE Leap=15.1
openSUSE Leap=15.2
Fedoraproject Fedora=32
Fedoraproject Fedora=33
Debian Debian Linux=10.0
Event History
Oct 15, 2020
CVE Published
12:00 AM
Nov 3, 2020
CVE Published
via MITRE·02:21 AM
Data Sourced
via MITRE·02:21 AM
DescriptionWeakness
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
1
What is CVE-2020-16004?
CVE-2020-16004 is a vulnerability in Google Chrome that allows a remote attacker to potentially exploit heap corruption.
2
Which versions of Google Chrome are affected by CVE-2020-16004?
Google Chrome versions prior to 86.0.4240.183 are affected by CVE-2020-16004.
3
How can a remote attacker exploit CVE-2020-16004?
A remote attacker can potentially exploit heap corruption by using a crafted HTML page.
4
What is the severity of CVE-2020-16004?
CVE-2020-16004 has a severity of 8.8 (high).
5
How can I fix CVE-2020-16004?
To fix CVE-2020-16004, update Google Chrome to version 86.0.4240.183 or later.