CVE-2020-16017

CVE-2020-16017 is a use-after-free vulnerability in the site isolation component of Google Chrome, fixed in version 86.0.4240.198. It is triggered by a crafted HTML page and requires the attacker to have already compromised the renderer process, for example via a chained renderer bug. By exploiting the flaw, the attacker can escape Chrome's renderer sandbox and gain code execution with broader privileges on the host system. Any user running an affected Chrome release prior to 86.0.4240.198 is exposed. The flaw was a zero-day exploited in active attacks at the time of disclosure, is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), and Google shipped the fix as an urgent stable-channel update.

What to do: Update Google Chrome to version 86.0.4240.198 or later and verify the installed version in the browser's About dialog; enable automatic updates so renderer/sandbox fixes are applied promptly. Administrators should audit managed endpoints for outdated Chrome builds and prioritize updates given the confirmed in-the-wild exploitation and KEV listing; the required action per CISA is to apply updates per vendor instructions.