CVE-2020-16009 — Vulnetix

CVE-2020-16009 PUBLISHED KEV

Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

EPSS 84.38% · 99.3th percentile

Risk Scores

EPSS Score

84.38%

99.3th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:16.04:LTS	chromium-browser	78.0.3904.97-0ubuntu0.16.04.1, 62.0.3202.94-0ubuntu0.16.04.1317, 63.0.3239.84-0ubuntu0.16.04.1
Ubuntu:18.04:LTS	chromium-browser	62.0.3202.62-0ubuntu0.17.10.1380, 62.0.3202.94-0ubuntu1.1388, 63.0.3239.84-0ubuntu1

Exploit Intelligence

http://packetstormsecurity.com/files/159974/Chrome-V8-Turbofan-Type-Confusion.html (nist-nvd)
https://crbug.com/1143772 (nist-nvd)
Type confusion in TurboFan map deprecation (Google Chrome) (gpz)
Type confusion in TurboFan map deprecation (Google Chrome) (gpz)
Type confusion in TurboFan map deprecation (Google Chrome) (gpz)
Type confusion in TurboFan map deprecation (Google Chrome) (gpz)
Type confusion in TurboFan map deprecation (Google Chrome) (gpz)
Type confusion in TurboFan map deprecation (Google Chrome) (gpz)
(vulncheck-xdb)
(vulncheck-xdb)

…and 42 more exploits

Timeline

Jan 20, 1970 VulnCheck XDB Entry
Jan 20, 1970 VulnCheck XDB Entry
Jan 20, 1970 VulnCheck XDB Entry
Jan 20, 1970 VulnCheck XDB Entry
Jan 20, 1970 VulnCheck XDB Entry
Jan 21, 1970 VulnCheck XDB Entry
Nov 2, 2020 PoC Published
Nov 3, 2020 CVE Published
Nov 9, 2020 PoC Published
Jan 4, 2021 CVE Updated
Apr 14, 2021 EPSS Score
Jun 8, 2021 VulnCheck KEV Exploitation

References

https://ubuntu.com/security/CVE-2020-16009 third-party-advisory
https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html third-party-advisory
https://crbug.com/1143772 third-party-advisory
https://www.cve.org/CVERecord?id=CVE-2020-16009 third-party-advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog third-party-advisory
Multiples vulnérabilités dans Google Chrome advisory

Open in Interactive Console →