CVE-2020-16010: critical vulnerability in Google Chrome
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply updates per vendor instructions.
A heap buffer overflow in Chrome's UI on Android allows an attacker who has already compromised the renderer process to escape the security sandbox and gain full device access. This is a critical vulnerability because it undermines Chrome's main defense mechanism.
Heap buffer overflow in the UI rendering component of Google Chrome on Android (versions prior to 86.0.4240.185) exploitable by a compromised renderer process through a crafted HTML page. The vulnerability enables sandbox escape, allowing potential elevation of privileges from renderer context to full system access. Attack vector requires prior code execution in the renderer process.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.