EXPOSURES › CVE-2020-16017
CVE-2020-16017
HIGH ⌖ ON CISA KEV · EXPLOITEDA use-after-free vulnerability in Google Chrome allowed sandbox escapes via crafted HTML pages after the renderer process was compromised.
This vulnerability enabled attackers to escape the Chrome sandbox once the renderer process was compromised, potentially leading to full system compromise. DIB organizations must ensure Chrome is patched and consider alternative browsers for high-assurance environments to prevent similar exploits.
Shame score — A known vulnerability in a widely used browser that allowed sandbox escapes, indicating a failure to patch or mitigate a critical flaw before exploitation.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Google Chrome contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.
"Google Chrome contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page."
| PRODUCT | STATUS |
|---|---|
| Google Services (Google Cloud Platform Products and underlying Infrastructure) Google |
Authorized |
| Google Workspace Google |
Authorized |