Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromised the renderer pr…

published 2020-11-03 6y ago modified 2026-06-17 4mo ago also EUVD-2020-7979

cvss: 9.6; version 3.1, CNA
cisa kev: Exploited; added 2021-11-03
epss: 6.4%; EPSS 6.4% chance of exploitation in 30 days, percentile 93%
public exploits: 0; none known

Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Patch / fix

cisa required action Apply updates per vendor instructions.

fixed in 1

Google Chrome 86.0.4240.185

Is CVE-2020-16010 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Timeline

2020-10-31 Found exploited as a 0-day (Project Zero)
2020-11-02 0-day patched (Project Zero)
2020-11-03 Published
2021-11-03 Added to CISA KEV
2022-05-03 CISA patch deadline
2024-05-20 CISA SSVC: exploitation active

Known exploited

Added: 5y ago (2021-11-03)
Patch by: 2022-05-03 (4y ago)
Ransomware: Not known
Required action: Apply updates per vendor instructions.
Vendor, product: Google, Chrome for Android UI
CISA name: Google Chrome for Android UI Heap Buffer Overflow Vulnerability

Zero-day

Detected in real attacks while still unknown to the vendor and the public, per Google Project Zero's 0day In-the-Wild tracker.

Found: 2020-10-31
Patched: 2020-11-02
Details: project zero root cause analysis

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: no
Technical impact: total
Assessed: 2y ago (2024-05-20)

Exploit prediction

6.36% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	9.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD	3.1	9.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CNA	3.1	9.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
NVD	2.0	6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P

Affected products

Google Chrome
google android

Classification

Weakness

CWE-122 Heap-based Buffer Overflow
CWE-787 Out-of-bounds Write

Technology feeds

Google Chrome rss critical rss

References

crbug.com /1144368
issue-tracking, vendor-advisory
chromereleases.googleblog.com /2020/11/chrome-for-android-update.html
vendor-advisory
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-16010
government-resource, us-government-resource

Sources

CVE List CVE-2020-16010
NVD CVE-2020-16010

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

json critical feed