cbcvebase.
CVE-2020-6549
published 2020-09-21

CVE-2020-6549: Use after free in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

PriorityP259high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
29.29%
97.9th percentile
Use after free in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Affected

10 ranges
VendorProductVersion rangeFixed in
chromiumchromium>= 0 < 87.0.4280.88-0.187.0.4280.88-0.1
chromiumchromium>= 0 < 87.0.4280.88-0.187.0.4280.88-0.1
chromiumchromium>= 0 < 87.0.4280.88-0.187.0.4280.88-0.1
chromiumchromium>= 0 < 87.0.4280.88-0.187.0.4280.88-0.1
debianchromium< chromium 87.0.4280.88-0.1 (bookworm)chromium 87.0.4280.88-0.1 (bookworm)
debiandebian_linux
fedoraprojectfedora
googlechrome< 84.0.4147.12584.0.4147.125
googlechrome>= unspecified < 84.0.4147.12584.0.4147.125
googlechrome_chrome

Detection & IOCsextracted from sources · hover to see the quote

  • Vulnerability exists in Google Chrome versions prior to 84.0.4147.125; presence of older versions indicates exposure to CVE-2020-6549 (use after free in media component)
  • Exploitation is triggered via a crafted HTML page delivered remotely; monitor for suspicious media-related HTML content or renderer crashes in Chrome's media component
  • Track Chromium issue 1105426 for technical details; internal bug ID can be used to correlate patch diffs or PoC references
  • ·No public PoC, exploit payload, or specific IOCs (hashes, IPs, domains, signatures) were disclosed in the available sources; detection must rely on version checking and crash telemetry
  • ·Debian resolved the issue in version 87.0.4280.88-0.1 across multiple release tracks, meaning systems running between 84.0.4147.125 and 87.0.4280.88 on Debian may still be at risk depending on backport status

CVSS provenance

nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.09.3CRITICALAV:N/AC:M/Au:N/C:C/I:C/A:C
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.