Vulnerability record · CVE-2020-15999 · published 3 November 2020
CVE-2020-15999: FreeType heap buffer overflow in Chrome via crafted HTML page
Google · Chrome
FreeType contains a heap buffer overflow reachable through a crafted HTML page in Google Chrome prior to 86.0.4240.111. The flaw is an out-of-bounds write (CWE-787, also described as a classic buffer overflow) that can corrupt heap memory. Because FreeType is a widely embedded font library, the same defect affects other products that bundle it, not just Chrome.
Description
Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.6, CISA KEV listing with documented exploit references and a very high EPSS percentile make this a top remediation priority despite the user-interaction requirement.
What it is
FreeType contains a heap buffer overflow reachable through a crafted HTML page in Google Chrome prior to 86.0.4240.111. The flaw is an out-of-bounds write (CWE-787, also described as a classic buffer overflow) that can corrupt heap memory. Because FreeType is a widely embedded font library, the same defect affects other products that bundle it, not just Chrome.
Impact
An attacker can corrupt heap memory and potentially achieve code execution in the context of the affected process. The CVSS 3.1 vector rates scope as changed with high confidentiality, integrity and availability impact, so a successful exploit can extend beyond the vulnerable component.
Attack surface
Reached remotely over the network by rendering a crafted HTML page that triggers font parsing; the vector requires user interaction (UI:R) and no privileges (PR:N). No authentication is needed, but the victim must load the malicious content.
Exploitation
CVE-2020-15999 is listed in CISA KEV with a 2021-11-03 addition date, and references are tagged Exploit, including the Chromium issue and a Google Project Zero root-cause writeup. EPSS gives a 30-day probability of 0.44303 (98.7th percentile), indicating high predicted exploitation activity.
What to do
- Update Google Chrome to 86.0.4240.111 or later, and apply the corresponding FreeType fixes distributed by Debian, Fedora, openSUSE, Gentoo and NetApp.
- Track FreeType as a shared dependency: inventory applications and appliances that embed it and confirm each has a patched version.
- Enforce browser auto-update and block or restrict use of unsupported browser versions on managed endpoints.
- Apply vendor instructions referenced in the CISA KEV entry within the stated remediation window.
Detection
- Monitor for crashes or abnormal process termination in Chrome and other FreeType-linked applications, which can indicate heap corruption attempts.
- Hunt for Chrome or browser processes spawning unexpected child processes or making anomalous outbound connections after rendering untrusted web content.
- Review proxy and DNS logs for delivery of exploit pages to endpoints running Chrome versions below 86.0.4240.111.
- Verify installed Chrome and FreeType package versions across endpoints and flag any that remain unpatched.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2020-15999 to the Known Exploited Vulnerabilities catalog on 3 November 2021 as "Google Chrome FreeType Heap Buffer Overflow Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 17 November 2021.
Affected products
6 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2020-15999 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-15999), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
