CVE-2020-16004

—

CVSS 3.1

8.8 high

EPSS

2%p73

Published

Nov 3, 2020 (Nov 3, 2020)

Modified

Jun 17, 2026

Description

Use after free in user interface in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Vendors: google opensuse fedoraproject debian
Products: chrome, backports sle, leap, fedora, debian linux
Weakness: CWE-416, CWE-787
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (1.5%)

In the news2 stories

Google fixes the second zero-day in Chrome in 2 weeks actively exploited

Security AffairsNov 3, 08:25 UTC · Nov 3, 2020Exploit / PoC in the wildCVE-2020-16009 CVE-2020-16010 CVE-2020-16004+7 CVEs

Chinese experts earned $20,000 for reporting a Chrome Sandbox Escape

Security AffairsMar 31, 14:56 UTC · Mar 31, 2021Vulnerability CVE-2021-21194 CVE-2021-21195 CVE-2021-21196+4 CVEs