⚠ Actively exploited
Added to CISA KEV on 2022-01-10. Federal agencies required to patch by 2022-07-10. Required action: Apply updates per vendor instructions..

CVE-2020-6572 — Use After Free in Google Chrome

CWE-416 — Use After Free10 documents9 sources
Severity
8.8HIGHNVD
EPSS
19.1%
top 4.65%
CISA KEV
KEV
Added 2022-01-10
Due 2022-07-10
Exploit
Exploited in wild
Active exploitation observed
Affected products
4
Google ChromeChromiumDebian Chromium+1 more
Timeline
PublishedJan 14
KEV addedJan 10
Latest updateMay 24
KEV dueJul 10
CISA Required Action: Apply updates per vendor instructions.

Description

Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages5 packages

▶CVEListV5google/chromeunspecified — 81.0.4044.92
▶NVDgoogle/chrome< 81.0.4044.92
▶debiandebian/chromium< chromium 81.0.4044.92-1 (bookworm)
▶Debianchromium/chromium< 81.0.4044.92-1+3

🔴Vulnerability Details

5
GHSA
GHSA-48wj-mfx4-4qc2: Use after free in Media in Google Chrome prior to 81↗2022-05-24
▶
Project0
Déjà vu-lnerability - Project Zero↗2021-02-01
▶
OSV
CVE-2020-6572: Use after free in Media in Google Chrome prior to 81↗2021-01-14
▶
VulnCheck
Google Chrome Media Use-After-Free Vulnerability↗2020
▶
Project0
Project Zero RCA: CVE-2020-6572: Chrome MediaCodecAudioDecoder Sandbox Escape↗
▶

📋Vendor Advisories

3
CISA
Google Chrome Media Use-After-Free Vulnerability↗2022-01-10
▶
Chrome
Stable Channel Update for Desktop: CVE-2020-6455↗2020-04-07
▶
Debian
CVE-2020-6572: chromium - Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote ...↗2020
▶

🕵️Threat Intelligence

1
Qualys
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR | Qualys↗2022-02-23
▶