Show vulnerabilities with patch / with exploit

Multiple vulnerabilities in Google Chrome



Published: 2020-07-15
Severity High
Patch available YES
Number of vulnerabilities 37
CVE ID CVE-2020-6527
CVE-2020-6521
CVE-2020-6522
CVE-2020-6523
CVE-2020-6524
CVE-2020-6525
CVE-2020-6526
CVE-2020-6528
CVE-2020-6519
CVE-2020-6529
CVE-2020-6530
CVE-2020-6531
CVE-2020-6533
CVE-2020-6534
CVE-2020-6535
CVE-2020-6536
CVE-2020-6520
CVE-2020-6518
CVE-2020-6517
CVE-2020-6510
CVE-2020-6511
CVE-2020-6512
CVE-2020-6513
CVE-2020-6514
CVE-2020-6515
CVE-2020-6516
CWE ID CWE-119
CWE-264
CWE-310
CWE-358
CWE-787
CWE-122
CWE-451
CWE-284
CWE-125
CWE-843
CWE-20
CWE-416
Exploitation vector Network
Public exploit Public exploit code for vulnerability #35 is available.
Vulnerable software
Subscribe
Google Chrome
Client/Desktop applications / Web browsers

Vendor Google, Inc.

Security Advisory

1) Memory corruption

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: N/A

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1103195
https://crbug.com/1090543

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Permissions, Privileges, and Access Controls

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-6527

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient policy enforcement in CSP in Google Chrome. A remote attacker can trick the victim to visit a specially crafted website, bypass implemented security measures and gain access to sensitive information.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/992698

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Cryptographic issues

Severity: Medium

CVSSv3: 5.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-6521

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to side-channel information leak in autofill. Chrome Medium. A remote attacker can create a specially crafted web page, trick the victim into opening it and gain access to sensitive information.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1075734

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Improperly implemented security check for standard

Severity: High

CVSSv3: 7.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-6522

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in external protocol handlers in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1052093

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Out-of-bounds write

Severity: Medium

CVSSv3: 6.5 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-6523

CWE-ID: CWE-787 - Out-of-bounds Write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in Skia. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1080481

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Heap-based buffer overflow

Severity: Medium

CVSSv3: 6.5 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-6524

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in WebAudio. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1081722

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Heap-based buffer overflow

Severity: Medium

CVSSv3: 6.5 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-6525

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in Skia. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1091670

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Improperly implemented security check for standard

Severity: Low

CVSSv3: 2.7 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-6526

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in iframe sandbox in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1074340

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Spoofing attack

Severity: Medium

CVSSv3: 4.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-6528

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in basic auth in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1063690

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Improper access control

Severity: Medium

CVSSv3: 5.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-6519

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improper access restrictions in CSP. A remote attacker can create a specially crafted web page, trick the victim into visiting it, bypass implemented security restrictions and gain unauthorized access to sensitive information.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1064676

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Improperly implemented security check for standard

Severity: Low

CVSSv3: 2.7 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-6529

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to incorrect implementation in WebRTC in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/978779

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Out-of-bounds read

Severity: Medium

CVSSv3: 5.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-6530

CWE-ID: CWE-125 - Out-of-bounds Read

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to crash the browser.

The vulnerability exists due to a boundary condition within the developer tools component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger an out-of-bounds read error and crash the browser.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1016278

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Cryptographic issues

Severity: Low

CVSSv3: 2.7 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-6531

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to side-channel information leak in scroll to text. Chrome Low. A remote attacker can create a specially crafted web page, trick the victim into opening it and gain access to sensitive information.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1042986

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Type Confusion

Severity: Low

CVSSv3: 2.7 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-6533

CWE-ID: CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a type confusion error and crash the browser.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1069964

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Heap-based buffer overflow

Severity: Low

CVSSv3: 2.7 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-6534

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary error when processing untrusted HTML content in WebRTC. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and crash the browser.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1072412

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Input validation error

Severity: Low

CVSSv3: 2.7 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-6535

CWE-ID: CWE-20 - Improper Input Validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied input in WebUI in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and gain access to sensitive information.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1073409

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Spoofing attack

Severity: Medium

CVSSv3: 4.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-6536

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in PWAs in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it and spoof web page content.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1080934

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Heap-based buffer overflow

Severity: Medium

CVSSv3: 6.5 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-6520

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in Skia. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1092274

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Use-after-free

Severity: Medium

CVSSv3: 5.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-6518

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within developer tools in Google Chrome. A remote attacker can trick the victim into visiting a specially crafted web page, trigger a use-after-free error and gain access to sensitive information.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/986051

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Memory corruption

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: N/A

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1103195
https://crbug.com/1087629

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Security restrictions bypass

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to unspecified error. A remote attacker can gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1103195
https://crbug.com/1067854

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Memory corruption

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: N/A

CWE-ID: CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1103195
https://crbug.com/1065122

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Security restrictions bypass

Severity: Medium

CVSSv3: 4.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: N/A

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to unspecified error. A remote attacker can bypass imposed security restrictions or gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1103195
https://crbug.com/1094453

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

24) Security restrictions bypass

Severity: Medium

CVSSv3: 4.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: N/A

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to unspecified error. A remote attacker can bypass imposed security restrictions or gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1103195
https://crbug.com/1072165

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

25) Security restrictions bypass

Severity: Medium

CVSSv3: 4.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: N/A

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to unspecified error. A remote attacker can bypass imposed security restrictions or gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1103195
https://crbug.com/1067869

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

26) Security restrictions bypass

Severity: Medium

CVSSv3: 4.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: N/A

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to unspecified error. A remote attacker can bypass imposed security restrictions or gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1103195
https://crbug.com/1065731

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

27) Security restrictions bypass

Severity: Medium

CVSSv3: 4.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: N/A

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to unspecified error. A remote attacker can bypass imposed security restrictions or gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1103195
https://crbug.com/1052492

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

28) Security restrictions bypass

Severity: Medium

CVSSv3: 4.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: N/A

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to unspecified error. A remote attacker can bypass imposed security restrictions or gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1103195
https://crbug.com/961644

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

29) Security restrictions bypass

Severity: Low

CVSSv3: 3.8 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions.

The vulnerability exists due to unspecified error. A remote attacker can gain access to sensitive information.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1103195
https://crbug.com/1029569

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

30) Heap-based buffer overflow

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-6517

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in history. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1095560

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

31) Heap-based buffer overflow

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-6510

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in background fetch. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1103195

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

32) Cryptographic issues

Severity: Medium

CVSSv3: 5.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-6511

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: No

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to side-channel information leak in content security policy. Chrome High. A remote attacker can create a specially crafted web page, trick the victim into opening it and gain access to sensitive information.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1074317

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

33) Type Confusion

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-6512

CWE-ID: CWE-843 - Access of Resource Using Incompatible Type ('Type Confusion')

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error within the V8 component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1084820

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

34) Heap-based buffer overflow

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-6513

CWE-ID: CWE-122 - Heap-based Buffer Overflow

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted HTML content in PDFium. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a heap-based buffer overflow and execute arbitrary code on the target system.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1091404

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

35) Improperly implemented security check for standard

Severity: Medium

CVSSv3: 4.8 [CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-6514

CWE-ID: CWE-358 - Improperly Implemented Security Check for Standard

Exploit availability: Yes [Search exploit]

Description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to WebRTC used the memory address of a class instance as a connection identifier. A remote attacker can use the obtained value to bypass ASLR protection.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1076703

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.

36) Use-after-free

Severity: High

CVSSv3: 7.7 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-6515

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the tab strip component in Google Chrome. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1082755

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

37) Improper access control

Severity: High

CVSSv3: 7.1 [CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C] [PCI]

CVE-ID: CVE-2020-6516

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to improper access restrictions in CORS. A remote attacker can create a specially crafted web page, trick the victim into visiting it, bypass implemented security restrictions and gain unauthorized access to sensitive information or manipulate data.

Mitigation

Update to version 84.0.4147.89.

Vulnerable software versions

Google Chrome: 84.0.4147.0, 84.0.4147.1, 84.0.4147.2, 84.0.4147.3, 84.0.4147.4, 84.0.4147.5, 84.0.4147.6, 84.0.4147.7, 84.0.4147.8, 84.0.4147.9, 84.0.4147.10, 84.0.4147.11, 84.0.4147.12, 84.0.4147.13, 84.0.4147.14, 84.0.4147.15, 84.0.4147.16, 84.0.4147.17, 84.0.4147.18, 84.0.4147.19, 84.0.4147.20, 84.0.4147.21, 84.0.4147.22, 84.0.4147.23, 84.0.4147.24, 84.0.4147.25, 84.0.4147.26, 84.0.4147.27, 84.0.4147.28, 84.0.4147.29, 84.0.4147.30, 84.0.4147.31, 84.0.4147.32, 84.0.4147.33, 84.0.4147.34, 84.0.4147.35, 84.0.4147.36, 84.0.4147.37, 84.0.4147.38, 84.0.4147.39, 84.0.4147.40, 84.0.4147.41, 84.0.4147.42, 84.0.4147.43, 84.0.4147.44, 84.0.4147.45, 84.0.4147.46, 84.0.4147.47, 84.0.4147.48, 84.0.4147.49, 84.0.4147.50, 84.0.4147.51, 84.0.4147.52, 84.0.4147.53, 84.0.4147.54, 84.0.4147.55, 84.0.4147.56, 84.0.4147.57, 84.0.4147.58, 84.0.4147.59, 84.0.4147.60, 84.0.4147.61, 84.0.4147.62, 84.0.4147.63, 84.0.4147.64, 84.0.4147.65, 84.0.4147.66, 84.0.4147.67, 84.0.4147.68, 84.0.4147.69, 84.0.4147.70, 84.0.4147.71, 84.0.4147.72, 84.0.4147.73, 84.0.4147.74, 84.0.4147.75, 84.0.4147.76, 84.0.4147.77, 84.0.4147.78, 84.0.4147.79, 84.0.4147.80, 84.0.4147.81, 84.0.4147.82, 84.0.4147.83, 84.0.4147.84, 84.0.4147.85, 84.0.4147.86, 84.0.4147.87, 84.0.4147.88

CPE External links

https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.html
https://crbug.com/1092449

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.