CVE-2020-6572highunder attackCWE-416

CVE-2020-6572: high-severity vulnerability in Google Chrome

Published · Updated

Follow this CVE+ Monitor Chrome+ Monitor Chrome Media

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

56Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 8.8epss 11%
from disclosure to weapon
Published on NVDJan 14
CISA KEV+361d
Action required by CISAfederal deadline: 2022-07-10

Apply updates per vendor instructions.

In short

Google Chrome had a memory safety bug in its media handling that could let attackers run malicious code when you visit a specially crafted website. This is dangerous because it can give attackers full control of your browser and computer.

Technical detail

Use-after-free vulnerability in Chrome's Media component (CWE-416) allowing remote code execution via crafted HTML. Attack vector is network-based requiring user interaction (visiting malicious page); the vulnerability stems from improper memory management in media processing. Impact is arbitrary code execution with Chrome process privileges.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected products
Google · Chrome
Related CVEs — Google Chrome

In the same product, most dangerous first.

CVE-2023-4863HIGHCVE-2023-4863EPSS 100.0%KEVCVE-2018-17463HIGHCVE-2018-17463EPSS 84.6%KEVCVE-2021-21224HIGHCVE-2021-21224EPSS 84.2%KEVCVE-2020-6418HIGHCVE-2020-6418EPSS 78.8%KEVCVE-2022-2294HIGHCVE-2022-2294EPSS 70.8%KEVCVE-2021-21220HIGHCVE-2021-21220EPSS 70.4%KEV