CVE-2020-6553: Use After Free
An use after free flaw was found in the offline mode component of the Chromium browser.
Upstream bug(s):
https://code.google.com/p/chromium/issues/detail?id=1111307
External References:
https://chromereleases.googleblog.com/2020/08/stable-channel-update-for-desktop.html
Other sources
Use after free in offline mode in Google Chrome on iOS prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 90.0.4430.212-1~deb10u1Fixed in 116.0.5845.180-1~deb11u1Fixed in 120.0.6099.129-1~deb11u1Fixed in 119.0.6045.199-1~deb12u1Fixed in 120.0.6099.129-1~deb12u1Fixed in 120.0.6099.129-1 - Upgrade
Upgrade
redhat/chromium-browserto a version that resolves this vulnerability.Fixed in 84.0.4147.125 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 84.0.4147.125
Event History
Frequently Asked Questions
What must an attacker do to exploit this issue?
The attacker needs to persuade a user to open a crafted HTML page. The vulnerability is remotely reachable and requires no attacker privileges, but user interaction is required.
Which Chrome deployments are explicitly identified as affected?
The description identifies Google Chrome on iOS in offline mode before version 84.0.4147.125. The supplied software list also includes Debian Chromium, Debian Linux, and Fedora, but does not provide affected version ranges or configuration details for those entries.
Is normal browsing necessarily affected?
The available information specifically identifies offline mode. It does not establish whether configurations outside offline mode are affected.