CVE-2020-16043:

Insufficient data validation in Google Chrome's networking component allows remote attackers to bypass discretionary access controls.

Score
A numerical rating that indicates how dangerous this vulnerability is.

8.8High

Published Date:Jan 8, 2021
CISA KEV Date:*No Data*
Industries Affected:20

Threat Predictions

EPSS Score:0.4
EPSS Percentile:59%

Exploitability

Score:2.8
Attack Vector:NETWORK
Attack Complexity:LOW
Privileges Required:NONE
User Interaction:REQUIRED
Scope:UNCHANGED

Impact

Score:5.9
Confidentiality Impact:HIGH
Integrity Impact:HIGH
Availability Impact:HIGH

Description Preview

Insufficient data validation in Google Chrome's networking component allows remote attackers to bypass discretionary access controls.

Overview

This vulnerability in Google Chrome's networking component represents a security flaw where input data is not properly validated. When exploited, an attacker can bypass discretionary access controls (DAC), which are security mechanisms that restrict access to objects based on the identity of subjects and/or groups to which they belong. The issue affects all Chrome installations prior to version 87.0.4280.141 across multiple platforms. The exact technical details of the exploitation method have not been publicly disclosed, as the bug report (crbug.com/1148309) requires special permissions to access.

Remediation

Users and administrators should take the following actions to mitigate this vulnerability:
1. Update Google Chrome to version 87.0.4280.141 or later.
2. For managed environments, ensure that automatic updates are enabled or deploy the updated version through your standard software distribution mechanisms.
3. If immediate updating is not possible, consider implementing network-level controls to restrict potentially malicious network traffic.
4. Users of Fedora, Debian, and Gentoo Linux distributions should apply their respective security updates as referenced in the advisory links.
5. Verify the update was successful by checking Chrome's version (Help > About Google Chrome).