KEV · Actively exploited

CVE-2020-15999

CRITICAL 9.6 KEV Published on 2020-11-03

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Attack vector : Network No privileges required

Show raw CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS 50.63% exploit likely percentile 98.8%

CISA Known Exploited Vulnerability

Added to KEV: 2021-11-03
Remediation deadline: 2021-11-17
Required action: Apply updates per vendor instructions.
Ransomware: Unknown (not documented by CISA)

OS versions that fix this CVE

This CVE is resolved by the following OS security releases. Update the OS to at least the listed version.

Android Fixed in January 2021 patch level

View on NVD ↗ CISA KEV catalog ↗