CVE-2020-16009: Inappropriate implementation in V8
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Other sources
Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 90.0.4430.212-1~deb10u1Fixed in 116.0.5845.180-1~deb11u1Fixed in 120.0.6099.129-1~deb11u1Fixed in 119.0.6045.199-1~deb12u1Fixed in 120.0.6099.129-1~deb12u1Fixed in 120.0.6099.129-1 - Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 86.0.4240.183
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2020-16009?
CVE-2020-16009 is a type confusion vulnerability in the Google Chromium V8 Engine.
Which software is affected by CVE-2020-16009?
Web browsers that utilize Chromium, including Google Chrome and Microsoft Edge, are affected by CVE-2020-16009.
What is the severity of CVE-2020-16009?
CVE-2020-16009 has a severity score of 8.8 (high).
How can a remote attacker exploit CVE-2020-16009?
A remote attacker can potentially exploit CVE-2020-16009 by using a crafted HTML page to exploit heap corruption.
Where can I find more information about CVE-2020-16009?
You can find more information about CVE-2020-16009 at the following references: [Link 1](http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html), [Link 2](http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00017.html), [Link 3](http://packetstormsecurity.com/files/159974/Chrome-V8-Turbofan-Type-Confusion.html).