Confirmed as exploited
CVE-2020-16009
Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
01 / ACTION
Required action
Apply updates per vendor instructions.
02 / AFFECTED SOFTWARE
Affected packages
34 explicit affected versions
87 explicit affected versions
86 explicit affected versions
94 explicit affected versions
4 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Google Chromium V8 Engine contains a type confusion vulnerability that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2020-16009: Inappropriate implementation in V8 - https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16009 Google is aware of reports that exploits for CVE-2020-16009 exist in the wild. Allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. There is currently little to no public information on the issue other than it has been flagged as `High` severity.
05 / REFERENCES
Further evidence
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00017.html
- http://packetstormsecurity.com/files/159974/Chrome-V8-Turbofan-Type-Confusion.html
- https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html
- https://crbug.com/1143772
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S4XYJ7B6OXHZNYSA5J3DBUOFEC6WCAGW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M/
- https://security.gentoo.org/glsa/202011-12
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-16009
- https://www.debian.org/security/2021/dsa-4824
- https://github.com/cefsharp/CefSharp
- https://github.com/cefsharp/CefSharp/security/advisories/GHSA-m7mf-48hp-5qmr
- https://lists.fedoraproject.org/archives/list/[email protected]/message/S4XYJ7B6OXHZNYSA5J3DBUOFEC6WCAGW
- https://lists.fedoraproject.org/archives/list/[email protected]/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M
- https://nvd.nist.gov/vuln/detail/CVE-2020-16009