CVE-2020-16017

CRITICAL KEV

Google Chrome < 86.0.4240.198 - Use-After-Free in Site Isolation

Title source: llm

Exploitation Summary

CVE-2020-16017 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added November 3, 2021.

Description

Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

References (3)

Core 3

Core References

Release Notes, Vendor Advisory x_refsource_misc

https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_11.html

Permissions Required, Vendor Advisory x_refsource_misc

https://crbug.com/1146709

US Government Resource

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-16017

Scores

CVSS v3 9.6

EPSS 0.2142

EPSS Percentile 95.8%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment

Exploitation active

Automatable no

Technical Impact total

Details

CISA KEV 2021-11-03

VulnCheck KEV 2020-11-07

InTheWild.io 2020-11-07

ENISA EUVD EUVD-2020-1456

CWE

CWE-416

Status published

Products (5)

google/chrome < 86.0.4240.198

nuget/CefSharp.Common 0 - 86.0.241NuGet

nuget/CefSharp.WinForms 0 - 86.0.241NuGet

nuget/CefSharp.Wpf 0 - 86.0.241NuGet

nuget/CefSharp.Wpf.HwndHost 0 - 86.0.241NuGet

Published Jan 08, 2021

KEV Added Nov 03, 2021

Tracked Since Feb 18, 2026