CVE-2020-16040: Insufficient data validation in V8

Q: What is the severity of CVE-2020-16040?

CVE-2020-16040 is categorized as a critical vulnerability due to potential remote code execution risks.

Q: How do I fix CVE-2020-16040?

The recommended fix for CVE-2020-16040 is to upgrade to the latest version of Google Chrome or Chromium above 87.0.4280.88.

Q: What software is affected by CVE-2020-16040?

CVE-2020-16040 affects Google Chrome versions prior to 87.0.4280.88 and specific versions of the Chromium browser.

Q: Can CVE-2020-16040 be exploited through web pages?

Yes, CVE-2020-16040 can be exploited via crafted HTML pages that cause heap corruption.

Q: What are the implications of CVE-2020-16040?

Exploitation of CVE-2020-16040 could allow an attacker to execute arbitrary code in the context of the affected browser.

Published Nov 19, 2020

Updated

Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Credit

Lucas Pinheiro, Microsoft Browser Vulnerability Research

Affected Software

3 affected componentsFixes available

debian/chromium

90.0.4430.212-1~deb10u1116.0.5845.180-1~deb11u1120.0.6099.129-1~deb11u1119.0.6045.199-1~deb12u1120.0.6099.129-1~deb12u1120.0.6099.129-1

Google Chrome<87.0.4280.88

87.0.4280.88

Google Chrome<87.0.4280.88

Remediation

Patch Available

https://crbug.com/1150649

Event History

Nov 19, 2020

CVE Published

12:00 AM

Jan 8, 2021

CVE Published

via MITRE·05:54 PM

Data Sourced

via MITRE·05:54 PM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

2952833725589367718

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2020-16040?