Risk High
Patch available YES
Number of vulnerabilities 8
CVE ID CVE-2020-13871
CVE-2020-15358
CVE-2020-15993
CVE-2020-15994
CVE-2020-15995
CVE-2020-15996
CVE-2020-15997
CVE-2020-15998
CWE ID CWE-416
CWE-787
Exploitation vector Network
Public exploit N/A
Vulnerable software
Subscribe
Google Chrome

Client/Desktop applications /
Web browsers
Vendor Google, Inc.

Security Advisory

1) Use-after-free

Risk: High

CVSSv3:
6.5 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID:
CVE-2020-13871

CWE-ID:
CWE-416 – Use After Free

Exploit availability:
No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in resetAccumulator() function in select.c. A remote attacker can pass specially crafted data to the application, trigger a use-after-free error and crash the service or execute arbitrary code on the target system

Mitigation

Install update from vendor’s website.

Vulnerable software versions

Google Chrome:
86.0.4240.0, 86.0.4240.1, 86.0.4240.2, 86.0.4240.3, 86.0.4240.4, 86.0.4240.5, 86.0.4240.6, 86.0.4240.7, 86.0.4240.8, 86.0.4240.9, 86.0.4240.10, 86.0.4240.11, 86.0.4240.12, 86.0.4240.13, 86.0.4240.14, 86.0.4240.15, 86.0.4240.16, 86.0.4240.17, 86.0.4240.18, 86.0.4240.19, 86.0.4240.20, 86.0.4240.21, 86.0.4240.22, 86.0.4240.23, 86.0.4240.24, 86.0.4240.25, 86.0.4240.26, 86.0.4240.27, 86.0.4240.28, 86.0.4240.29, 86.0.4240.30, 86.0.4240.31, 86.0.4240.32, 86.0.4240.33, 86.0.4240.34, 86.0.4240.35, 86.0.4240.36, 86.0.4240.37, 86.0.4240.38, 86.0.4240.39, 86.0.4240.40, 86.0.4240.41, 86.0.4240.42, 86.0.4240.43, 86.0.4240.44, 86.0.4240.45, 86.0.4240.46, 86.0.4240.47, 86.0.4240.48, 86.0.4240.49, 86.0.4240.50, 86.0.4240.51, 86.0.4240.52, 86.0.4240.53, 86.0.4240.54, 86.0.4240.55, 86.0.4240.56, 86.0.4240.57, 86.0.4240.58, 86.0.4240.59, 86.0.4240.60, 86.0.4240.61, 86.0.4240.62, 86.0.4240.63, 86.0.4240.64, 86.0.4240.65, 86.0.4240.66, 86.0.4240.67, 86.0.4240.68, 86.0.4240.69, 86.0.4240.70, 86.0.4240.71, 86.0.4240.72, 86.0.4240.73, 86.0.4240.74, 86.0.4240.75, 86.0.4240.76, 86.0.4240.77, 86.0.4240.78, 86.0.4240.79, 86.0.4240.80, 86.0.4240.81, 86.0.4240.92, 86.0.4240.93, 86.0.4240.94, 86.0.4240.95

CPE

External links

https://www.sqlite.org/src/info/79eff1d0383179c4
https://www.sqlite.org/src/info/c8d3b9f0a750a529
https://www.sqlite.org/src/info/cd708fa84d2aaaea
https://chromereleases.googleblog.com/2020/10/chrome-for-android-update_31.html
https://bugs.chromium.org/p/chromium/issues/detail?id=1117367

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Out-of-bounds write

Risk: Low

CVSSv3:
4.8 [CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID:
CVE-2020-15358

CWE-ID:
CWE-787 – Out-of-bounds Write

Exploit availability:
No

Description

The vulnerability allows a local authenticated user to perform a denial of service (DoS) attack.

In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.

Mitigation

Install update from vendor’s website.

Vulnerable software versions

Google Chrome:
86.0.4240.0, 86.0.4240.1, 86.0.4240.2, 86.0.4240.3, 86.0.4240.4, 86.0.4240.5, 86.0.4240.6, 86.0.4240.7, 86.0.4240.8, 86.0.4240.9, 86.0.4240.10, 86.0.4240.11, 86.0.4240.12, 86.0.4240.13, 86.0.4240.14, 86.0.4240.15, 86.0.4240.16, 86.0.4240.17, 86.0.4240.18, 86.0.4240.19, 86.0.4240.20, 86.0.4240.21, 86.0.4240.22, 86.0.4240.23, 86.0.4240.24, 86.0.4240.25, 86.0.4240.26, 86.0.4240.27, 86.0.4240.28, 86.0.4240.29, 86.0.4240.30, 86.0.4240.31, 86.0.4240.32, 86.0.4240.33, 86.0.4240.34, 86.0.4240.35, 86.0.4240.36, 86.0.4240.37, 86.0.4240.38, 86.0.4240.39, 86.0.4240.40, 86.0.4240.41, 86.0.4240.42, 86.0.4240.43, 86.0.4240.44, 86.0.4240.45, 86.0.4240.46, 86.0.4240.47, 86.0.4240.48, 86.0.4240.49, 86.0.4240.50, 86.0.4240.51, 86.0.4240.52, 86.0.4240.53, 86.0.4240.54, 86.0.4240.55, 86.0.4240.56, 86.0.4240.57, 86.0.4240.58, 86.0.4240.59, 86.0.4240.60, 86.0.4240.61, 86.0.4240.62, 86.0.4240.63, 86.0.4240.64, 86.0.4240.65, 86.0.4240.66, 86.0.4240.67, 86.0.4240.68, 86.0.4240.69, 86.0.4240.70, 86.0.4240.71, 86.0.4240.72, 86.0.4240.73, 86.0.4240.74, 86.0.4240.75, 86.0.4240.76, 86.0.4240.77, 86.0.4240.78, 86.0.4240.79, 86.0.4240.80, 86.0.4240.81, 86.0.4240.92, 86.0.4240.93, 86.0.4240.94, 86.0.4240.95

CPE

External links

https://security.netapp.com/advisory/ntap-20200709-0001/
https://www.sqlite.org/src/info/10fa79d00f8091e5
https://www.sqlite.org/src/timeline?p=version-3.32.3&bt=version-3.32.2
https://www.sqlite.org/src/tktview?name=8f157e8010
https://chromereleases.googleblog.com/2020/10/chrome-for-android-update_31.html
https://bugs.chromium.org/p/chromium/issues/detail?id=1117367

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

The attacker would have to login to the system and perform certain actions in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free

Risk: High

CVSSv3:
7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID:
CVE-2020-15993

CWE-ID:
CWE-416 – Use After Free

Exploit availability:
No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in printing. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the target system.


Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor’s website.

Vulnerable software versions

Google Chrome:
86.0.4240.0, 86.0.4240.1, 86.0.4240.2, 86.0.4240.3, 86.0.4240.4, 86.0.4240.5, 86.0.4240.6, 86.0.4240.7, 86.0.4240.8, 86.0.4240.9, 86.0.4240.10, 86.0.4240.11, 86.0.4240.12, 86.0.4240.13, 86.0.4240.14, 86.0.4240.15, 86.0.4240.16, 86.0.4240.17, 86.0.4240.18, 86.0.4240.19, 86.0.4240.20, 86.0.4240.21, 86.0.4240.22, 86.0.4240.23, 86.0.4240.24, 86.0.4240.25, 86.0.4240.26, 86.0.4240.27, 86.0.4240.28, 86.0.4240.29, 86.0.4240.30, 86.0.4240.31, 86.0.4240.32, 86.0.4240.33, 86.0.4240.34, 86.0.4240.35, 86.0.4240.36, 86.0.4240.37, 86.0.4240.38, 86.0.4240.39, 86.0.4240.40, 86.0.4240.41, 86.0.4240.42, 86.0.4240.43, 86.0.4240.44, 86.0.4240.45, 86.0.4240.46, 86.0.4240.47, 86.0.4240.48, 86.0.4240.49, 86.0.4240.50, 86.0.4240.51, 86.0.4240.52, 86.0.4240.53, 86.0.4240.54, 86.0.4240.55, 86.0.4240.56, 86.0.4240.57, 86.0.4240.58, 86.0.4240.59, 86.0.4240.60, 86.0.4240.61, 86.0.4240.62, 86.0.4240.63, 86.0.4240.64, 86.0.4240.65, 86.0.4240.66, 86.0.4240.67, 86.0.4240.68, 86.0.4240.69, 86.0.4240.70, 86.0.4240.71, 86.0.4240.72, 86.0.4240.73, 86.0.4240.74, 86.0.4240.75, 86.0.4240.76, 86.0.4240.77, 86.0.4240.78, 86.0.4240.79, 86.0.4240.80, 86.0.4240.81, 86.0.4240.92, 86.0.4240.93, 86.0.4240.94, 86.0.4240.95

CPE

External links

https://chromereleases.googleblog.com/2020/10/chrome-for-android-update_31.html
https://bugs.chromium.org/p/chromium/issues/detail?id=1133983

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Use-after-free

Risk: High

CVSSv3:
7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID:
CVE-2020-15994

CWE-ID:
CWE-416 – Use After Free

Exploit availability:
No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in V8. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor’s website.

Vulnerable software versions

Google Chrome:
86.0.4240.0, 86.0.4240.1, 86.0.4240.2, 86.0.4240.3, 86.0.4240.4, 86.0.4240.5, 86.0.4240.6, 86.0.4240.7, 86.0.4240.8, 86.0.4240.9, 86.0.4240.10, 86.0.4240.11, 86.0.4240.12, 86.0.4240.13, 86.0.4240.14, 86.0.4240.15, 86.0.4240.16, 86.0.4240.17, 86.0.4240.18, 86.0.4240.19, 86.0.4240.20, 86.0.4240.21, 86.0.4240.22, 86.0.4240.23, 86.0.4240.24, 86.0.4240.25, 86.0.4240.26, 86.0.4240.27, 86.0.4240.28, 86.0.4240.29, 86.0.4240.30, 86.0.4240.31, 86.0.4240.32, 86.0.4240.33, 86.0.4240.34, 86.0.4240.35, 86.0.4240.36, 86.0.4240.37, 86.0.4240.38, 86.0.4240.39, 86.0.4240.40, 86.0.4240.41, 86.0.4240.42, 86.0.4240.43, 86.0.4240.44, 86.0.4240.45, 86.0.4240.46, 86.0.4240.47, 86.0.4240.48, 86.0.4240.49, 86.0.4240.50, 86.0.4240.51, 86.0.4240.52, 86.0.4240.53, 86.0.4240.54, 86.0.4240.55, 86.0.4240.56, 86.0.4240.57, 86.0.4240.58, 86.0.4240.59, 86.0.4240.60, 86.0.4240.61, 86.0.4240.62, 86.0.4240.63, 86.0.4240.64, 86.0.4240.65, 86.0.4240.66, 86.0.4240.67, 86.0.4240.68, 86.0.4240.69, 86.0.4240.70, 86.0.4240.71, 86.0.4240.72, 86.0.4240.73, 86.0.4240.74, 86.0.4240.75, 86.0.4240.76, 86.0.4240.77, 86.0.4240.78, 86.0.4240.79, 86.0.4240.80, 86.0.4240.81, 86.0.4240.92, 86.0.4240.93, 86.0.4240.94, 86.0.4240.95

CPE

External links

https://chromereleases.googleblog.com/2020/10/chrome-for-android-update_31.html
https://bugs.chromium.org/p/chromium/issues/detail?id=1117258

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Out-of-bounds write

Risk: High

CVSSv3:
7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID:
CVE-2020-15995

CWE-ID:
CWE-787 – Out-of-bounds Write

Exploit availability:
No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.


The vulnerability exists due to a boundary error when processing untrusted input in V8. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Install updates from vendor’s website.

Vulnerable software versions

Google Chrome:
86.0.4240.0, 86.0.4240.1, 86.0.4240.2, 86.0.4240.3, 86.0.4240.4, 86.0.4240.5, 86.0.4240.6, 86.0.4240.7, 86.0.4240.8, 86.0.4240.9, 86.0.4240.10, 86.0.4240.11, 86.0.4240.12, 86.0.4240.13, 86.0.4240.14, 86.0.4240.15, 86.0.4240.16, 86.0.4240.17, 86.0.4240.18, 86.0.4240.19, 86.0.4240.20, 86.0.4240.21, 86.0.4240.22, 86.0.4240.23, 86.0.4240.24, 86.0.4240.25, 86.0.4240.26, 86.0.4240.27, 86.0.4240.28, 86.0.4240.29, 86.0.4240.30, 86.0.4240.31, 86.0.4240.32, 86.0.4240.33, 86.0.4240.34, 86.0.4240.35, 86.0.4240.36, 86.0.4240.37, 86.0.4240.38, 86.0.4240.39, 86.0.4240.40, 86.0.4240.41, 86.0.4240.42, 86.0.4240.43, 86.0.4240.44, 86.0.4240.45, 86.0.4240.46, 86.0.4240.47, 86.0.4240.48, 86.0.4240.49, 86.0.4240.50, 86.0.4240.51, 86.0.4240.52, 86.0.4240.53, 86.0.4240.54, 86.0.4240.55, 86.0.4240.56, 86.0.4240.57, 86.0.4240.58, 86.0.4240.59, 86.0.4240.60, 86.0.4240.61, 86.0.4240.62, 86.0.4240.63, 86.0.4240.64, 86.0.4240.65, 86.0.4240.66, 86.0.4240.67, 86.0.4240.68, 86.0.4240.69, 86.0.4240.70, 86.0.4240.71, 86.0.4240.72, 86.0.4240.73, 86.0.4240.74, 86.0.4240.75, 86.0.4240.76, 86.0.4240.77, 86.0.4240.78, 86.0.4240.79, 86.0.4240.80, 86.0.4240.81, 86.0.4240.92, 86.0.4240.93, 86.0.4240.94, 86.0.4240.95

CPE

External links

https://chromereleases.googleblog.com/2020/10/chrome-for-android-update_31.html
https://bugs.chromium.org/p/chromium/issues/detail?id=1132111

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Use-after-free

Risk: High

CVSSv3:
7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID:
CVE-2020-15996

CWE-ID:
CWE-416 – Use After Free

Exploit availability:
No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in passwords. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the target system.


Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor’s website.

Vulnerable software versions

Google Chrome:
86.0.4240.0, 86.0.4240.1, 86.0.4240.2, 86.0.4240.3, 86.0.4240.4, 86.0.4240.5, 86.0.4240.6, 86.0.4240.7, 86.0.4240.8, 86.0.4240.9, 86.0.4240.10, 86.0.4240.11, 86.0.4240.12, 86.0.4240.13, 86.0.4240.14, 86.0.4240.15, 86.0.4240.16, 86.0.4240.17, 86.0.4240.18, 86.0.4240.19, 86.0.4240.20, 86.0.4240.21, 86.0.4240.22, 86.0.4240.23, 86.0.4240.24, 86.0.4240.25, 86.0.4240.26, 86.0.4240.27, 86.0.4240.28, 86.0.4240.29, 86.0.4240.30, 86.0.4240.31, 86.0.4240.32, 86.0.4240.33, 86.0.4240.34, 86.0.4240.35, 86.0.4240.36, 86.0.4240.37, 86.0.4240.38, 86.0.4240.39, 86.0.4240.40, 86.0.4240.41, 86.0.4240.42, 86.0.4240.43, 86.0.4240.44, 86.0.4240.45, 86.0.4240.46, 86.0.4240.47, 86.0.4240.48, 86.0.4240.49, 86.0.4240.50, 86.0.4240.51, 86.0.4240.52, 86.0.4240.53, 86.0.4240.54, 86.0.4240.55, 86.0.4240.56, 86.0.4240.57, 86.0.4240.58, 86.0.4240.59, 86.0.4240.60, 86.0.4240.61, 86.0.4240.62, 86.0.4240.63, 86.0.4240.64, 86.0.4240.65, 86.0.4240.66, 86.0.4240.67, 86.0.4240.68, 86.0.4240.69, 86.0.4240.70, 86.0.4240.71, 86.0.4240.72, 86.0.4240.73, 86.0.4240.74, 86.0.4240.75, 86.0.4240.76, 86.0.4240.77, 86.0.4240.78, 86.0.4240.79, 86.0.4240.80, 86.0.4240.81, 86.0.4240.92, 86.0.4240.93, 86.0.4240.94, 86.0.4240.95

CPE

External links

https://chromereleases.googleblog.com/2020/10/chrome-for-android-update_31.html
https://bugs.chromium.org/p/chromium/issues/detail?id=1133635

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Use-after-free

Risk: High

CVSSv3:
7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID:
CVE-2020-15997

CWE-ID:
CWE-416 – Use After Free

Exploit availability:
No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in Mojo. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor’s website.

Vulnerable software versions

Google Chrome:
86.0.4240.0, 86.0.4240.1, 86.0.4240.2, 86.0.4240.3, 86.0.4240.4, 86.0.4240.5, 86.0.4240.6, 86.0.4240.7, 86.0.4240.8, 86.0.4240.9, 86.0.4240.10, 86.0.4240.11, 86.0.4240.12, 86.0.4240.13, 86.0.4240.14, 86.0.4240.15, 86.0.4240.16, 86.0.4240.17, 86.0.4240.18, 86.0.4240.19, 86.0.4240.20, 86.0.4240.21, 86.0.4240.22, 86.0.4240.23, 86.0.4240.24, 86.0.4240.25, 86.0.4240.26, 86.0.4240.27, 86.0.4240.28, 86.0.4240.29, 86.0.4240.30, 86.0.4240.31, 86.0.4240.32, 86.0.4240.33, 86.0.4240.34, 86.0.4240.35, 86.0.4240.36, 86.0.4240.37, 86.0.4240.38, 86.0.4240.39, 86.0.4240.40, 86.0.4240.41, 86.0.4240.42, 86.0.4240.43, 86.0.4240.44, 86.0.4240.45, 86.0.4240.46, 86.0.4240.47, 86.0.4240.48, 86.0.4240.49, 86.0.4240.50, 86.0.4240.51, 86.0.4240.52, 86.0.4240.53, 86.0.4240.54, 86.0.4240.55, 86.0.4240.56, 86.0.4240.57, 86.0.4240.58, 86.0.4240.59, 86.0.4240.60, 86.0.4240.61, 86.0.4240.62, 86.0.4240.63, 86.0.4240.64, 86.0.4240.65, 86.0.4240.66, 86.0.4240.67, 86.0.4240.68, 86.0.4240.69, 86.0.4240.70, 86.0.4240.71, 86.0.4240.72, 86.0.4240.73, 86.0.4240.74, 86.0.4240.75, 86.0.4240.76, 86.0.4240.77, 86.0.4240.78, 86.0.4240.79, 86.0.4240.80, 86.0.4240.81, 86.0.4240.92, 86.0.4240.93, 86.0.4240.94, 86.0.4240.95

CPE

External links

https://chromereleases.googleblog.com/2020/10/chrome-for-android-update_31.html
https://bugs.chromium.org/p/chromium/issues/detail?id=1133668

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Use-after-free

Risk: High

CVSSv3:
7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID:
CVE-2020-15998

CWE-ID:
CWE-416 – Use After Free

Exploit availability:
No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.


The vulnerability exists due to a use-after-free error in USB. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor’s website.

Vulnerable software versions

Google Chrome:
86.0.4240.0, 86.0.4240.1, 86.0.4240.2, 86.0.4240.3, 86.0.4240.4, 86.0.4240.5, 86.0.4240.6, 86.0.4240.7, 86.0.4240.8, 86.0.4240.9, 86.0.4240.10, 86.0.4240.11, 86.0.4240.12, 86.0.4240.13, 86.0.4240.14, 86.0.4240.15, 86.0.4240.16, 86.0.4240.17, 86.0.4240.18, 86.0.4240.19, 86.0.4240.20, 86.0.4240.21, 86.0.4240.22, 86.0.4240.23, 86.0.4240.24, 86.0.4240.25, 86.0.4240.26, 86.0.4240.27, 86.0.4240.28, 86.0.4240.29, 86.0.4240.30, 86.0.4240.31, 86.0.4240.32, 86.0.4240.33, 86.0.4240.34, 86.0.4240.35, 86.0.4240.36, 86.0.4240.37, 86.0.4240.38, 86.0.4240.39, 86.0.4240.40, 86.0.4240.41, 86.0.4240.42, 86.0.4240.43, 86.0.4240.44, 86.0.4240.45, 86.0.4240.46, 86.0.4240.47, 86.0.4240.48, 86.0.4240.49, 86.0.4240.50, 86.0.4240.51, 86.0.4240.52, 86.0.4240.53, 86.0.4240.54, 86.0.4240.55, 86.0.4240.56, 86.0.4240.57, 86.0.4240.58, 86.0.4240.59, 86.0.4240.60, 86.0.4240.61, 86.0.4240.62, 86.0.4240.63, 86.0.4240.64, 86.0.4240.65, 86.0.4240.66, 86.0.4240.67, 86.0.4240.68, 86.0.4240.69, 86.0.4240.70, 86.0.4240.71, 86.0.4240.72, 86.0.4240.73, 86.0.4240.74, 86.0.4240.75, 86.0.4240.76, 86.0.4240.77, 86.0.4240.78, 86.0.4240.79, 86.0.4240.80, 86.0.4240.81, 86.0.4240.92, 86.0.4240.93, 86.0.4240.94, 86.0.4240.95

CPE

External links

https://chromereleases.googleblog.com/2020/10/chrome-for-android-update_31.html
https://bugs.chromium.org/p/chromium/issues/detail?id=1135857

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



Source link

Is your business effected by Cyber Crime?

If a cyber crime or cyber attack happens to you, you need to respond quickly. Cyber crime in its several formats such as online identity theft, financial fraud, stalking, bullying, hacking, e-mail fraud, email spoofing, invoice fraud, email scams, banking scam, CEO fraud. Cyber fraud can lead to major disruption and financial disasters. Contact Digitpol’s hotlines or respond to us online.

Digitpol’s Cyber Crime Investigation Unit provides investigative support to victims of cyber crimes. Digitpol is available 24/7. https://digitpol.com/cybercrime-investigation/

Europe +31558448040
UK +44 20 8089 9944
ASIA +85239733884