CVE-2020-16010

CVE-2020-16010 is a heap buffer overflow (out-of-bounds write, CWE-787/CWE-122) in the UI layer of Google Chrome on Android, fixed in version 86.0.4240.185. It is triggered by a crafted HTML page after a remote attacker has already compromised the Chrome renderer process, meaning it typically functions as a second-stage component of an exploit chain. Successful exploitation lets the attacker escape Chrome's sandbox, moving from the isolated renderer to broader access on the device, with confidentiality, integrity, and availability all rated high (CVSS 3.1: 9.6). Users running Chrome on Android prior to 86.0.4240.185 are affected. The flaw is confirmed exploited in the wild — it was added to CISA's Known Exploited Vulnerabilities catalog on 2021-11-03 — and EPSS assigns a 6.4% probability of exploitation in the next 30 days (93rd percentile).

What to do: Update Chrome on Android to 86.0.4240.185 or later via Google Play and confirm the version on the device (chrome://version); given the CISA KEV listing, treat this patch as urgent. Because the bug requires a prior renderer compromise, also ensure the device's Chrome build includes all current renderer fixes, and enable Play Store auto-updates on managed fleets.