CVE-2020-16017: critical vulnerability in Google Chrome
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
A memory flaw in Google Chrome allowed attackers who compromised the browser's rendering process to escape the security sandbox through a specially crafted webpage. This could give them access to your system beyond the browser's protections.
Use-after-free vulnerability in Chrome's site isolation mechanism (CWE-416) permitted sandbox escape when renderer process was compromised. Attack vector requires prior renderer compromise; impact is sandbox escape with potential system-level code execution. Affected versions prior to 86.0.4240.198.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.