Vulnerability record · CVE-2020-16010 · published 3 November 2020
CVE-2020-16010: Google Chrome for Android UI heap buffer overflow sandbox escape
Google · Chrome
Chrome for Android before 86.0.4240.185 has a heap buffer overflow in the UI component. An attacker who already controls the renderer process can use a crafted HTML page to break out of the browser sandbox, which is why it matters despite the prerequisite compromise.
Description
Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Automated analysis
high priorityCritical CVSS and KEV listing indicate real-world exploitation, but the renderer-compromise prerequisite and user interaction lower the immediate risk compared with a fully remote pre-auth flaw.
What it is
Chrome for Android before 86.0.4240.185 has a heap buffer overflow in the UI component. An attacker who already controls the renderer process can use a crafted HTML page to break out of the browser sandbox, which is why it matters despite the prerequisite compromise.
Impact
An attacker gains code execution outside the Chrome sandbox on the Android device, escalating from a compromised renderer to the broader system. This can lead to data theft or further compromise of the device.
Attack surface
Reached remotely over the network via a crafted HTML page, requiring user interaction to render it. No authentication is needed, but the attacker must first have compromised the renderer process.
Exploitation
Listed in CISA KEV since 2021-11-03, indicating known exploitation in the wild. EPSS 30-day probability is about 6.4 percent (93rd percentile), and references are vendor advisories and issue tracking with no public exploit tag.
What to do
- Update Chrome for Android to 86.0.4240.185 or later per the vendor advisory.
- Enforce automatic updates or managed patching for Chrome on Android devices.
- Restrict or monitor untrusted web content on managed Android devices where feasible.
- Track CISA KEV remediation due date of 2022-05-03 and confirm all devices are patched.
Detection
- Monitor for Chrome for Android versions below 86.0.4240.185 in asset inventories.
- Look for crashes or abnormal renderer-to-browser IPC activity in Chrome on Android.
- Review web proxy or DNS logs for delivery of crafted HTML pages to Android devices.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2020-16010 to the Known Exploited Vulnerabilities catalog on 3 November 2021 as "Google Chrome for Android UI Heap Buffer Overflow Vulnerability". Required action: Apply updates per vendor instructions. Federal deadline 3 May 2022.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://chromereleases.googleblog.com/2020/11/chrome-for-android-update.html | Vendor Advisory |
| https://crbug.com/1144368 | Issue TrackingVendor Advisory |
| https://chromereleases.googleblog.com/2020/11/chrome-for-android-update.html | Vendor Advisory |
| https://crbug.com/1144368 | Issue TrackingVendor Advisory |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-16010 | US Government Resource |
Track CVE-2020-16010 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-16010), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
