CVE-2020-15999

A heap buffer overflow in Google Chrome's FreeType font rendering library was actively exploited in the wild as part of an exploit chain.

The vulnerability allowed remote code execution via malicious PNG images embedded in fonts, which was part of a known exploit chain targeting Windows and Android. DIB organizations must ensure their browsers are patched and monitor for supply-chain compromises in open-source libraries like FreeType. This is not a zero-day as it was part of an active exploit chain.

Shame score — The vulnerability was actively exploited in the wild as part of an exploit chain, indicating a failure to patch a known issue before it was weaponized.