CVE-2020-16017: Google Chrome site isolation use-after-free sandbox escape

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityIt is a KEV-listed sandbox escape with critical CVSS impact, but exploitation requires a prior renderer compromise and user interaction, lowering standalone risk.

What it is

Chrome before 86.0.4240.198 contains a use-after-free in site isolation. An attacker who already controls a renderer process can use a crafted HTML page to break out of the browser sandbox. Because it defeats the sandbox, it is a serious escalation primitive rather than a standalone initial-access bug.

Impact

An attacker with an existing renderer compromise gains code execution outside the sandbox, typically at the browser's privilege level, enabling access to user data and the host system.

Attack surface

Reached over the network via a crafted HTML page, requiring user interaction to load it. The attacker must first have compromised the renderer process, so this is a second-stage exploit, not an unauthenticated remote entry point.

Exploitation

Listed in CISA KEV with a 2022-05-03 remediation due date, indicating known exploitation. EPSS 30-day probability is about 2.7 percent (85th percentile), so mass scanning is not indicated, but targeted use is plausible.

What to do

• Update Chrome to 86.0.4240.198 or later, or the current stable release, on all endpoints.
• Verify version compliance across managed fleets and block or force-update outdated Chrome installs.
• Keep site isolation enabled and avoid disabling it for compatibility.
• Reduce renderer compromise opportunities by limiting untrusted web content and enforcing browser hardening baselines.
• Track KEV remediation deadlines and confirm closure for internet-facing and high-value users.

Detection

• Alert on Chrome versions below 86.0.4240.198 in asset inventory or endpoint telemetry.
• Monitor for browser processes spawning unexpected child processes or writing outside normal profile paths.
• Hunt for renderer crashes followed by suspicious post-exploitation activity on the same host.
• Correlate proxy or DNS logs for known exploit-delivery pages with endpoint browser version data.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.