CVE-2020-6378: Use After Free
Use after free in speech in Google Chrome prior to 79.0.3945.130 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 79.0.3945.130 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What must an attacker do to exploit this issue?
An attacker must get a user to interact with a crafted HTML page. The flaw is remotely reachable and requires no attacker privileges, but user interaction is required.
Which Chrome versions are affected?
Google Chrome versions before 79.0.3945.130 are affected. The listed software also includes Debian Chromium and Fedora, but the provided data does not specify their fixed package versions.
What is the potential impact of successful exploitation?
Successful exploitation could allow heap corruption and may affect confidentiality, integrity, and availability. The CVSS vector rates each of those impacts as high.