CVE-2020-6572

CVE-2020-6572 is a use-after-free (CWE-416) in the Media component of Google Chrome that allows a remote attacker to execute arbitrary code by persuading a user to open a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R) shows the attack is network-delivered but requires user interaction, meaning a victim must load attacker-controlled web content for the memory corruption to occur. Successful exploitation yields high confidentiality, integrity, and availability impact — effectively remote code execution in the context of the browser. All Google Chrome versions prior to 81.0.4044.92 are affected, so the exposure is any Chrome install that has not applied that release or later. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-01-10), confirming exploitation in the wild, and EPSS assigns a 10.6% probability of exploitation in the next 30 days (96th percentile).

What to do: Update Google Chrome to 81.0.4044.92 or later — any currently maintained release satisfies this — and verify the running version at chrome://settings/help with auto-update enabled. Prioritize legacy or offline systems (old workstations, kiosks, VDI golden images) that may still run 2020-era Chrome, since the KEV listing (added 2022-01-10) makes remediation mandatory for federal agencies.