Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2020-16040 — Improper Input Validation in Google Chrome

CWE-20 — Improper Input Validation CWE-190 — Integer Overflow or Wraparound CWE-787 — Out-of-bounds Write15 documents11 sources

Severity

6.5MEDIUMNVD

EPSS

75.1%

top 1.12%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Google Chrome Chromium Debian Chromium +1 more

Timeline

PublishedJan 8

Latest updateJan 26

Description

Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HExploitability: 2.8 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5google/chromeunspecified — 87.0.4280.88

▶NVDgoogle/chrome< 87.0.4280.88

▶googlegoogle/chrome_chrome

▶debiandebian/chromium< chromium 87.0.4280.88-0.1 (bookworm)

▶Debianchromium/chromium< 87.0.4280.88-0.1+3

Patches

Patch: crbug.com ↗Patch: crbug.com ↗

🔴Vulnerability Details

GHSA

GHSA-6v42-384q-wwf5: Insufficient data validation in V8 in Google Chrome prior to 87↗2022-05-24

▶

OSV

CVE-2020-16040: Insufficient data validation in V8 in Google Chrome prior to 87↗2021-01-08

▶

VulnCheck

Google Chrome Improper Input Validation↗2020

▶

Project0

Project Zero RCA: CVE-2021-0920: Android sk_buff use-after-free in Linux↗

▶

💥Exploits & PoCs

Exploit-DB

Google Chrome 86.0.4240 V8 - Remote Code Execution↗2021-04-06

▶

Metasploit

Google Chrome versions before 87.0.4280.88 integer overflow during SimplfiedLowering phase↗

▶

📋Vendor Advisories

Chrome

Stable Channel Update for Desktop: CVE-2020-16040↗2020-12-02

▶

Debian

CVE-2020-16040: chromium - Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowe...↗2020

▶