CVE-2020-6463

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-05-21 · updated 2026-06-17
Weakness: CWE-416

Description

Use after free in ANGLE in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Affected products

Canonical Ubuntu Linux: 16.04, 18.04, 20.04
Debian Linux: 9.0, 10.0
Fedoraproject Fedora: 31, 32
Google Chrome: before 81.0.4044.122 — fixed in 81.0.4044.122
openSUSE Backports Sle: 15.0-sp1
openSUSE Leap: 15.1, 15.2

How to fix

Upgrade to a fixed version: Google Chrome 81.0.4044.122. Check the vendor advisory for mitigations.

References

http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00034.html
http://lists.opensuse.org/opensuse-security-announce/2020-06/msg00038.html
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00008.html
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00011.html
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00022.html
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00025.html
http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00032.html
https://chromereleases.googleblog.com/2020/04/stable-channel-update-for-desktop_21.html
https://crbug.com/1065186
https://lists.debian.org/debian-lts-announce/2020/07/msg00027.html
https://lists.debian.org/debian-lts-announce/2020/08/msg00006.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OQYH5OK7O4BU6E37WWG5SEEHV65BFSGR/

Get alerted when CVE-2020-6463 or the next vulnerability affects your stack