CVE-2020-6572
Google Chrome Media Use-After-Free Vulnerability
Description
CVE-2020-6572 is a high-severity use after free vulnerability in the Media component of Google Chrome. In versions prior to 81.0.4044.92, a remote attacker could exploit this flaw to execute arbitrary code by tricking a user into visiting a crafted HTML page. The underlying weakness involves referencing memory after it has been freed, which can lead to code execution when the stale pointer is dereferenced. CISA has added CVE-2020-6572 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. With an EPSS score of 19.07% (95.2nd percentile), this Google Chrome vulnerability presents a significant exploitation probability that demands prompt remediation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 81.0.4044.92 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_7.html(Release Notes, Vendor Advisory)
- https://crbug.com/1066893(Permissions Required, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-6572(US Government Resource)
Weakness Type
CWE-416: Use After Free
Use After Free is a memory corruption vulnerability that occurs when software continues to reference a pointer after the associated memory has been freed. In the context of CVE-2020-6572, the Media component in Google Chrome improperly managed memory lifecycle during media processing operations, allowing freed memory to be accessed through a dangling pointer. An attacker could manipulate heap allocations to place controlled data in the freed memory region, ultimately achieving arbitrary code execution when Chrome dereferences the stale pointer.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2020-6572 carries a CVSS 3.1 base score of 8.8 (HIGH), reflecting serious security implications for affected systems. The vulnerability is remotely exploitable over the network with low attack complexity, meaning no special conditions are required beyond convincing a user to visit a malicious web page. While no authentication is needed to launch the attack, user interaction is required in the form of navigating to an attacker-controlled page. Successful exploitation results in full compromise of confidentiality, integrity, and availability, allowing an attacker to execute arbitrary code within the context of the browser process, potentially accessing sensitive user data, modifying browser behavior, or causing the application to crash. With an EPSS score of 19.07%, this vulnerability has a high probability of active exploitation, underscoring the importance of immediate patching for all Google Chrome installations prior to version 81.0.4044.92.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2020-6572 in the wild by including it in the Known Exploited Vulnerabilities catalog, with a remediation deadline of 2022-07-10. The EPSS score of 19.07% (95.2nd percentile) indicates a high likelihood of exploitation activity, placing this vulnerability among the most actively targeted flaws. While no publicly tagged exploit code appears in the NVD references, the KEV listing and high EPSS percentile confirm that threat actors have developed and deployed working exploits against the Chrome Media use-after-free vulnerability. Organizations running unpatched versions of Google Chrome should treat this as an urgent security issue requiring immediate action.
Remediation
- Update Google Chrome immediately to version 81.0.4044.92 or later, as directed by CISA KEV required action: "Apply updates per vendor instructions." Verify the update through Chrome's built-in update mechanism (chrome://settings/help).
- Enable automatic updates for Google Chrome across all managed endpoints to ensure future security patches are applied promptly. Use enterprise management tools (e.g., Google Admin Console, SCCM, or Intune) to enforce update policies.
- Implement browser isolation for high-risk users or environments where immediate patching is not feasible. Network-level controls such as web proxies with content inspection can help detect and block exploit delivery via crafted HTML pages.
- Monitor for indicators of compromise by reviewing endpoint detection logs for unusual process spawning from Chrome, unexpected memory access patterns, or suspicious child processes that could indicate successful exploitation of the use-after-free vulnerability.
- Adopt memory-safe development practices as a long-term strategy. Consider enabling Chrome's site isolation and strict site process separation to limit the impact of memory corruption vulnerabilities in browser components.
Technical Details
CVE-2020-6572 is a use-after-free vulnerability in the Media component of Google Chrome prior to version 81.0.4044.92. The flaw occurs when the browser's media processing subsystem frees a memory object but retains a pointer to that memory, which is subsequently dereferenced during media playback or processing operations. An attacker can craft a malicious HTML page that triggers the specific sequence of media operations needed to free the memory and then reallocate it with attacker-controlled content. The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates that while the attack requires user interaction to visit a malicious page, the exploitation itself is straightforward with low attack complexity and no privileges required. By carefully controlling heap layout through JavaScript heap spraying or similar techniques, an attacker can place a crafted object containing a malicious function pointer or vtable in the freed memory region, achieving arbitrary code execution when Chrome processes the stale reference.
Frequently Asked Questions
Is CVE-2020-6572 being actively exploited?
Yes. CVE-2020-6572 is listed in the CISA Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. The EPSS score of 19.07% (95.2nd percentile) further indicates a high probability of exploitation activity. Federal agencies were required to remediate by 2022-07-10.
What products are affected by CVE-2020-6572?
CVE-2020-6572 affects Google Chrome versions prior to 81.0.4044.92. The vulnerability specifically resides in the Media component of the browser. All platforms running vulnerable Chrome versions (Windows, macOS, Linux) are potentially impacted.
How do I fix CVE-2020-6572?
Update Google Chrome to version 81.0.4044.92 or later. Chrome's built-in auto-update mechanism will apply the fix automatically in most cases. Verify the installed version via chrome://settings/help and ensure automatic updates are enabled across all managed endpoints.
How severe is CVE-2020-6572?
CVE-2020-6572 has a CVSS 3.1 base score of 8.8 (HIGH). The vulnerability allows remote code execution through a crafted web page, with high impact on confidentiality, integrity, and availability. Its inclusion in the CISA KEV catalog and an EPSS score in the 95th percentile underscore the severity and urgency of this vulnerability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.