CVE-2020-6572: Google Chrome Media use-after-free allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw allows remote code execution with no privileges required and is confirmed exploited in the wild per CISA KEV, though it requires user interaction and a patched version has long been available.

What it is

Google Chrome before 81.0.4044.92 contains a use-after-free flaw in the Media component. A remote attacker can trigger it with a crafted HTML page, and successful exploitation leads to arbitrary code execution in the browser context.

Impact

An attacker who lands the exploit gains arbitrary code execution with the privileges of the Chrome process, which can lead to full compromise of the user's session and data.

Attack surface

Reached over the network by rendering a crafted HTML page; no authentication is required, but the victim must interact with the page (UI:R), typically by visiting attacker-controlled content.

Exploitation

CVE-2020-6572 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-01-10), indicating exploitation in the wild; EPSS gives a 30-day probability of about 10.6% (95.5th percentile). No ransomware campaign use is documented.

What to do

• Update Chrome to 81.0.4044.92 or later per the vendor release notes.
• Enforce automatic browser updates and verify version compliance across endpoints.
• Restrict or isolate browsing of untrusted web content where feasible.
• Track the CISA KEV due date (2022-07-10) and confirm remediation status.

Detection

• Monitor for Chrome renderer crashes or abnormal process terminations that may indicate use-after-free triggering.
• Hunt for Chrome spawning unexpected child processes or making anomalous network connections after browsing activity.
• Review proxy and DNS logs for access to known malicious or exploit-hosting domains.
• Check endpoint telemetry for suspicious code execution originating from browser processes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.