CVE-2020-16009

Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Published: Nov 3, 2020
Updated: Jun 7, 2023
CVE: CVE-2020-16009
GHSA: GHSA-m7mf-48hp-5qmr
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 8.8
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2:

Severity: Medium
Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P

CWEs:

CWE-787
CWE-843

Affected Software
References

Software	From	Fixed in
google / chrome	-	86.0.4240.183
microsoft / edge_chromium	-	86.0.4240.183
microsoft / edge	-	86.0.622.63
opensuse / leap	15.1	15.1.x
opensuse / backports_sle	15.0-sp1	15.0-sp1.x
opensuse / leap	15.2	15.2.x
opensuse / backports_sle	15.0-sp2	15.0-sp2.x
fedoraproject / fedora	32	32.x
fedoraproject / fedora	33	33.x
debian / debian_linux	10.0	10.0.x
CefSharp.Common	-	86.0.241
CefSharp.Wpf	-	86.0.241
CefSharp.WinForms	-	86.0.241
CefSharp.Wpf.HwndHost	-	86.0.241
cefsharp / cefsharp	-	86.0.241

http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html
http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00017.html
http://packetstormsecurity.com/files/159974/Chrome-V8-Turbofan-Type-Confusion.html
https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html
https://crbug.com/1143772
https://github.com/cefsharp/CefSharp/security/advisories/GHSA-m7mf-48hp-5qmr
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4XYJ7B6OXHZNYSA5J3DBUOFEC6WCAGW/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S4XYJ7B6OXHZNYSA5J3DBUOFEC6WCAGW/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M/
https://security.gentoo.org/glsa/202011-12
https://www.debian.org/security/2021/dsa-4824

Vulnerability Database

CVE-2020-16009

Deep Security Visibility Without the Complexity