CVE-2020-16010
Published: 03 November 2020
Summary
CVE-2020-16010 is a critical-severity Out-of-bounds Write (CWE-787) vulnerability in Google Chrome. Its CVSS base score is 9.6 (Critical).
Operationally, ranked in the top 4.4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
The vulnerability CVE-2020-16010 is a heap buffer overflow in the UI component of Google Chrome on Android in versions prior to 86.0.4240.185. It is tracked under CWEs 787 and 122 and carries a CVSS 3.1 score of 9.6.
A remote attacker who has already compromised the renderer process can exploit the flaw by delivering a crafted HTML page, potentially achieving a sandbox escape that yields high impact on confidentiality, integrity, and availability.
Google's Chrome release notes direct users to update to version 86.0.4240.185 or later. The issue is also catalogued by CISA among known exploited vulnerabilities.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2020-7979
Vulnerability details
Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
- CWE(s)
- KEV Date Added
- 03 November 2021
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of the vendor patch (Chrome 86.0.4240.185+) that eliminates the heap buffer overflow.
Enforces memory-protection mechanisms that block exploitation of heap buffer overflows such as CWE-787/122.
Requires process isolation boundaries whose bypass is exactly the sandbox-escape objective of this renderer-to-UI flaw.