CVE-2020-6572
Google Chrome
Published 14 Jan 2021 · updated 17 Jun 2026 · Analyzed
8.8 High · CVSS 3.1, NVD
Exploited in the wild
CISA added this to its Known Exploited Vulnerabilities catalog on 10 Jan 2022, with a remediation deadline of 10 Jul 2022 for US federal agencies.
Required action: Apply updates per vendor instructions.
Description
Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
References
- chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html · Release Notes, Vendor Advisory
- crbug.com/1066893 · Permissions Required, Vendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-6572 · US Government Resource