Two New Chrome 0-Days Under Active Attacks

CVE-2020-16009 is a type confusion vulnerability (CWE-843) in the V8 JavaScript engine used by Google Chromium, which can lead to heap corruption (CWE-787). A remote attacker triggers it by getting a user to load a specially crafted HTML page, such as via a malicious or compromised website. Successful exploitation corrupts the heap and can potentially allow the attacker to execute code in the context of the affected browser. Any Chromium-based browser or application embedding V8 is affected, including Google Chrome, Microsoft Edge, and Opera, meaning the affected population is effectively the entire Chromium user base worldwide. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2021-11-03, confirming exploitation in the wild, with an EPSS probability of 48.3% (99th percentile); ransomware use is unknown and no public PoC is known.

Do: Apply the vendor update per CISA's required action: update all Chromium-based browsers (Chrome, Edge, Opera, and derivatives) to the latest stable releases from each vendor and restart browsers afterward. Inventory any embedded or packaged Chromium/V8 runtimes in other applications and update them as their maintainers ship fixes. Given confirmed in-the-wild exploitation and high EPSS, prioritize patching endpoints used for web browsing by high-risk users first.

Google Chrome's V8 JavaScript engine contained an inappropriate implementation (CWE-787, out-of-bounds write) that could corrupt the browser's heap. A remote attacker triggers the flaw by getting a user to open a crafted HTML page, since the bug is reached through JavaScript processing in the browser (user interaction is required, per the CVSS vector). Successful exploitation could allow the attacker to execute code in the browser with high confidentiality, integrity and availability impact, consistent with the 8.8 CVSS score. All Google Chrome users running versions prior to 86.0.4240.198 were affected, as are Chromium-based builds relying on the same V8 code. The flaw was a zero-day under active attack when Google patched it in the November 2020 stable-channel update; it was added to CISA KEV on 2021-11-03 (ransomware use unknown), carries a 2.8% EPSS (85th percentile), and no public PoC is known.

Do: Upgrade Google Chrome to 86.0.4240.198 or later on all endpoints and verify the running version at chrome://version; this is the November 2020 stable-channel release that patched the actively exploited zero-day. Chromium-based browsers (e.g., Edge, Brave, Opera, Vivaldi) inherit the V8 fix through their own upstream updates, so ensure the latest available release is deployed there as well. As a CISA KEV entry, the required action is to apply vendor updates per vendor instructions within the KEV patching deadline.

CVE-2020-16017 is a use-after-free vulnerability in the site isolation component of Google Chrome, fixed in version 86.0.4240.198. It is triggered by a crafted HTML page and requires the attacker to have already compromised the renderer process, for example via a chained renderer bug. By exploiting the flaw, the attacker can escape Chrome's renderer sandbox and gain code execution with broader privileges on the host system. Any user running an affected Chrome release prior to 86.0.4240.198 is exposed. The flaw was a zero-day exploited in active attacks at the time of disclosure, is listed in CISA's Known Exploited Vulnerabilities catalog (added 2021-11-03), and Google shipped the fix as an urgent stable-channel update.

Do: Update Google Chrome to version 86.0.4240.198 or later and verify the installed version in the browser's About dialog; enable automatic updates so renderer/sandbox fixes are applied promptly. Administrators should audit managed endpoints for outdated Chrome builds and prioritize updates given the confirmed in-the-wild exploitation and KEV listing; the required action per CISA is to apply updates per vendor instructions.