CVE-2020-16013

Google Chrome's V8 JavaScript engine contained an inappropriate implementation (CWE-787, out-of-bounds write) that could corrupt the browser's heap. A remote attacker triggers the flaw by getting a user to open a crafted HTML page, since the bug is reached through JavaScript processing in the browser (user interaction is required, per the CVSS vector). Successful exploitation could allow the attacker to execute code in the browser with high confidentiality, integrity and availability impact, consistent with the 8.8 CVSS score. All Google Chrome users running versions prior to 86.0.4240.198 were affected, as are Chromium-based builds relying on the same V8 code. The flaw was a zero-day under active attack when Google patched it in the November 2020 stable-channel update; it was added to CISA KEV on 2021-11-03 (ransomware use unknown), carries a 2.8% EPSS (85th percentile), and no public PoC is known.

What to do: Upgrade Google Chrome to 86.0.4240.198 or later on all endpoints and verify the running version at chrome://version; this is the November 2020 stable-channel release that patched the actively exploited zero-day. Chromium-based browsers (e.g., Edge, Brave, Opera, Vivaldi) inherit the V8 fix through their own upstream updates, so ensure the latest available release is deployed there as well. As a CISA KEV entry, the required action is to apply vendor updates per vendor instructions within the KEV patching deadline.