CVE-2020-16013

HIGH KEV

Google Chrome < 86.0.4240.198 - Out-of-bounds Write via Crafted HTML Page

Title source: llm

Exploitation Summary

CVE-2020-16013 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021.

Description

Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

References (3)

Core 3

Core References

Permissions Required, Vendor Advisory x_refsource_misc

https://crbug.com/1147206

Release Notes, Vendor Advisory x_refsource_misc

https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_11.html

US Government Resource

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-16013

Scores

CVSS v3 8.8

EPSS 0.2614

EPSS Percentile 96.4%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation active

Automatable no

Technical Impact total

Details

CISA KEV 2021-11-03

VulnCheck KEV 2020-11-09

InTheWild.io 2020-11-09

ENISA EUVD EUVD-2020-1474

CWE

CWE-787

Status published

Products (5)

google/chrome < 86.0.4240.198

nuget/CefSharp.Common 0 - 86.0.241NuGet

nuget/CefSharp.WinForms 0 - 86.0.241NuGet

nuget/CefSharp.Wpf 0 - 86.0.241NuGet

nuget/CefSharp.Wpf.HwndHost 0 - 86.0.241NuGet

Published Jan 08, 2021

KEV Added Nov 03, 2021

Tracked Since Feb 18, 2026