Google Chrome Use-After-Free Vulnerability

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

1. Jan 8, 2021 · Catalog

   Detected

   Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

2. Nov 3, 2021 · CISA KEV

   Known exploited

   Apply updates per vendor instructions.

3. May 3, 2022 · CISA KEV

   Remediation due

   Apply updates per vendor instructions.

4. Jun 16, 2026 · Catalog

   Updated

   Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Affected

• cpe google/chromeversion unspecified
• vendor Google Chromeversion unspecified

Sources

• CISA KEVConfirmed exploitationCVE-2020-16017

  Google Chrome contains a use-after-free vulnerability that allows a remote attacker, who has compromised the renderer process, to potentially perform a sandbox escape via a crafted HTML page.

  cisa.gov
• CVE.orgVulnerability recordCVE-2020-16017

  Official CVE identifier

  cve.org
• FIRST EPSSExploitation probabilityCVE-2020-16017

  30-day exploitation probability 2.7%

  first.org
• NIST NVDVulnerability recordCVE-2020-16017

  Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

  nvd.nist.gov

References

• Release Notes · chromereleases.googleblog.com
• Permissions Required · crbug.com
• CISA note · nvd.nist.gov
• US Government Resource · cisa.gov