CVE-2020-6572KEV ยท OVERDUE

Google Chrome Media Use-After-Free Vulnerability

High ยท published January 14, 2021

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 95.8th percentile for exploit probability.

1566
days past CISA
deadline
CVSS v3.1
8.8
EPSS
11%
Percentile
95.8
In the wild
Confirmed
What it is

๐Ÿšจ A crafty HTML page can exploit a use-after-free vulnerability in Google Chrome, giving attackers a golden ticket to execute arbitrary code. ๐Ÿ”ฅ Think of it like a library that forgets to check if a book is still checked out before allowing others to borrow it โ€” the next reader can snag something without permission! ๐Ÿ“š If an attacker successfully leverages this vulnerability, they could take complete control of your system, running malicious code as if they were you! This could lead to data breaches, unauthorized access, or even total system compromise, making it absolutely devastating for your security. โšก

Put simply

Think of it like a library that forgets to check if a book is still checked out before allowing others to borrow it โ€” the next reader can snag something without permission! ๐Ÿ“š This use-after-free flaw in the Media component of Google Chrome allows attackers to execute arbitrary code by crafting a specially designed HTML page that mismanages memory references.

What to do

If an attacker successfully leverages this vulnerability, they could take complete control of your system, running malicious code as if they were you! This could lead to data breaches, unauthorized access, or even total system compromise, making it absolutely devastating for your security. โšก To protect yourself, update your Google Chrome browser to version 81.0.4044.92 or later immediately. Regularly check for updates and consider enabling automatic updates to ensure you receive patches without delay. ๐Ÿ›ก๏ธ You've got this! With these steps, you're on your way to securing your browser and keeping the bad guys at bay! ๐Ÿ’ช๐Ÿ˜„

The record
Technical detail
CVSS v3.1
8.8 ยท HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.10586 ยท 95.8th percentile
Published
2021-01-14T20:55Z
KEV added
2022-01-10 ยท due 2022-07-10
EPSS history
Timeline
  • 10 JAN 00:00Z
    Added to CISA KEV โ€” remediate by Jul 10
    kev
  • 14 JAN 20:55Z
    Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page
    cvelistv5