CVE-2020-16017

Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Published: Jan 8, 2021
Updated: May 9, 2024
CVE: CVE-2020-16017
GHSA: GHSA-gvqv-779r-4jgp
Severity: Critical
Exploit:

CVSS v3:

Severity: Critical
Score: 9.6
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CVSS v2:

Severity: Medium
Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P

CWEs:

CWE-416

Affected Software
References

Software	From	Fixed in
google / chrome	-	86.0.4240.198
CefSharp.Common	-	86.0.241
CefSharp.Wpf	-	86.0.241
CefSharp.WinForms	-	86.0.241
CefSharp.Wpf.HwndHost	-	86.0.241

https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_11.html
https://crbug.com/1146709
https://github.com/cefsharp/CefSharp/security/advisories/GHSA-gvqv-779r-4jgp

Vulnerability Database

CVE-2020-16017

Deep Security Visibility Without the Complexity