CVE-2020-6572: Google Chrome Use After Free Vulnerability

CVE-2020-6572 Overview

CVE-2020-6572 is a use-after-free vulnerability [CWE-416] in the Media component of Google Chrome prior to version 81.0.4044.92. A remote attacker can execute arbitrary code by tricking a user into visiting a crafted HTML page. The flaw allows code execution in the context of the browser process, providing a foothold for further compromise. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. The EPSS probability score is approximately 19.07%, placing it in the 95th percentile for likelihood of exploitation.

Critical Impact
Remote attackers can achieve arbitrary code execution through a malicious web page, and the flaw is confirmed exploited in the wild per the CISA KEV catalog.

Affected Products

Google Chrome versions prior to 81.0.4044.92
Chromium-based browsers sharing the affected Media component code
Desktop platforms (Windows, macOS, Linux) running vulnerable Chrome builds

Discovery Timeline

2020-04-07 - Google releases Chrome 81.0.4044.92 stable channel update addressing the issue
2021-01-14 - CVE-2020-6572 published to NVD
2026-01-13 - Last updated in NVD database

Technical Details for CVE-2020-6572

Vulnerability Analysis

The vulnerability resides in Chrome's Media component, which handles audio and video playback, codec negotiation, and media stream processing. A use-after-free condition occurs when the browser continues to reference a memory object after it has been deallocated. Attackers can manipulate object lifetimes through crafted media elements on an attacker-controlled HTML page. Once the dangling pointer is dereferenced, an attacker who controls the freed memory region can hijack execution flow.

Successful exploitation yields high impact on confidentiality, integrity, and availability. Exploitation requires user interaction, typically loading the malicious page in a vulnerable Chrome build. Because the Media subsystem runs within the renderer process, exploitation generally provides initial code execution inside the renderer sandbox, which attackers chain with additional sandbox escape primitives to gain broader system access.

Root Cause

The root cause is improper management of object lifetime within the Media component. A heap object is freed while another code path retains and later dereferences a pointer to it. Reference details are tracked in Chrome Bug Report #1066893.

Attack Vector

The attack is network-based and requires user interaction. An attacker hosts a crafted HTML page containing media elements that trigger the vulnerable code path. When a victim visits the page using an unpatched Chrome build, the use-after-free is triggered, enabling arbitrary code execution within the renderer process.

No public proof-of-concept code is available in this dataset. Technical details are documented in the Google Chrome Stable Channel Update.

Detection Methods for CVE-2020-6572

Indicators of Compromise

Chrome renderer process crashes with heap corruption signatures referencing media playback modules
Unexpected child processes spawned by chrome.exe shortly after media-heavy page loads
Outbound connections from Chrome processes to unfamiliar domains following a crash event
Browser version strings reporting builds older than 81.0.4044.92 in endpoint inventory

Detection Strategies

Inventory Chrome versions across the fleet and flag any installation below 81.0.4044.92
Monitor for renderer process crashes correlated with visits to untrusted domains
Hunt for post-exploitation behavior such as chrome.exe spawning command shells or scripting hosts
Correlate web proxy logs with endpoint telemetry to identify exposure to known malicious media URLs

Monitoring Recommendations

Enable browser version reporting through endpoint management to surface non-compliant hosts
Forward Chrome crash telemetry and process lineage data to a centralized analytics platform
Alert on anomalous parent-child process relationships originating from browser processes
Track web traffic to newly registered or low-reputation domains hosting media content

How to Mitigate CVE-2020-6572

Immediate Actions Required

Update Chrome to version 81.0.4044.92 or later on all endpoints
Identify and remediate any Chromium-based applications embedding affected Media component versions
Verify automatic updates are enabled and functioning across managed installations
Prioritize remediation given the CISA KEV listing confirming in-the-wild exploitation

Patch Information

Google addressed CVE-2020-6572 in Chrome 81.0.4044.92, released April 7, 2020. Full release notes are available in the Google Chrome Stable Channel Update. The vulnerability is tracked in Chrome Bug Report #1066893 and listed in the CISA Known Exploited Vulnerabilities Catalog.

Workarounds

Restrict browsing on unpatched systems to trusted internal sites until the update is applied
Deploy URL filtering to block access to known malicious media-hosting domains
Apply application allowlisting to limit execution of unexpected child processes from browsers
Enforce least-privilege user accounts to reduce post-exploitation impact

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version