CVE-2020-6418: Google Chromium V8 Type Confusion Vulnerability

High severity · published Feb 27, 2020

CVE-2020-6418

Google Chromium V8 Type Confusion Vulnerability

In wildKEV

8.8

CVSS

78.8%

EPSS

Yes

On KEV

Description

Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

Required

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)78.8% · higher than 100% of CVEs

Exploited in the wildYes

CISA KEVListed Nov 3, 2021

Federal remediation dueMay 3, 2022

Ransomware campaign useNot known

Affected products

Which versions

Chrome · Google

before 80.0.3987.122 · source: vendor, NVD

Debian Linux · Debian

9.0; 10.0 · source: NVD

Enterprise Linux Desktop · Redhat

6.0 · source: NVD

Enterprise Linux Server · Redhat

6.0 · source: NVD

Enterprise Linux Workstation · Redhat

6.0 · source: NVD

Fedora · Fedoraproject

30; 31 · source: NVD

Chromium V8 · Google

All versions, or not specified · source: KEV

Affected product

Chrome

Google

All Chrome CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2020-6418

CVE.org

https://www.cve.org/CVERecord?id=CVE-2020-6418

CISA KEV catalogue

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

x_refsource_MISC

https://chromereleases.googleblog.com/2020/02/stable-channel-update-for-desktop_24.html

x_refsource_MISC

https://crbug.com/1053604

x_refsource_MISC

http://packetstormsecurity.com/files/156632/Google-Chrome-80-JSCreate-Side-Effect-Type-Confusion.html

vendor-advisory

https://access.redhat.com/errata/RHSA-2020:0738

vendor-advisory

https://www.debian.org/security/2020/dsa-4638

vendor-advisory

https://security.gentoo.org/glsa/202003-08