Actively exploited · Published Jan 14, 2021 · Assigned by Chrome
CVE-2020-6572
High 8.8 Exploited
In plain English
A high-severity use-after-free in Chrome from Google. Attackers are actively exploiting it in the wild (listed by CISA on January 10, 2022). The chance it is exploited in the next 30 days is estimated at 10.6% (higher than 96% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)10.6%top 4.2% of all CVEs
Exploited in the wildYesCISA KEV since Jan 10, 2022
Attack toolingNoneno public tooling known
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jul 10, 2022.
Official description
Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | chromium | 81.0.4044.92-1 | DEBIAN-CVE-2020-6572 |
| Debian:13 | chromium | 81.0.4044.92-1 | DEBIAN-CVE-2020-6572 |
| Debian:14 | chromium | 81.0.4044.92-1 | DEBIAN-CVE-2020-6572 |
Affected products (as reported)
Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://crbug.com/1066893 x_refsource_MISC
- https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html x_refsource_MISC
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-6572 government-resource