PT-2021-9849 · Google · Google Chrome

Published 2021-01-14 · Updated 2021-03-18 · CVE-2020-16045

Positive Technologies (AI Summary)

CVSS v3.1

9.6

Critical

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 87.0.4280.66

Description The issue allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. This is due to a Use after Free in Payments.

Recommendations For Google Chrome on Android versions prior to 87.0.4280.66, update to version 87.0.4280.66 or later to resolve the issue.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2020-16045

Affected Products

Google Chrome

References · 7

• https://crbug.com/1125614 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-16045 · Security Note
• https://osv.dev/vulnerability/CVE-2020-16045 · Vendor Advisory
• https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_17.html · Vendor Advisory
• https://t.me/cybersecuritytechnologies/2930 · Telegram Post
• https://t.me/cibsecurity/22190 · Telegram Post
• https://t.me/cvenotify/8557 · Telegram Post