High Severity Use‑After‑Free in Google Chrome Media (CVE‑2020‑6572) Enables Remote Code Execution
What It Is
A use‑after‑free flaw resides in the Chrome Media component of Google Chrome. When a maliciously crafted HTML page is rendered, the vulnerability can cause the browser to free memory that is still in use, allowing an attacker to inject and execute arbitrary code on the victim’s system.
Exploitability
The vulnerability is publicly disclosed, assigned CVSS 9.8 (High) and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Proof‑of‑concept code has been released, confirming remote‑code‑execution capability without user interaction beyond loading the page.
Affected Products
- Vendor: Google
- Product: Google Chrome (Media stack) – all versions prior to the security patch released in March 2021.
Why It Matters for Compliance & Audit Readiness
- Control Assurance: The flaw directly undermines endpoint integrity controls (e.g., NIST CSF PR.IP‑1, ISO 27001 A.12.2). Demonstrating timely remediation is essential for a defensible audit trail.
- Continuous Monitoring: Detecting unpatched Chrome instances via asset inventory tools provides evidence of due‑diligence and supports vendor‑management controls.
- Audit Evidence: Documented patch deployment and verification can satisfy regulator‑mandated proof of risk mitigation for web‑browser exposure, a common attack surface in privacy‑impact assessments.
Recommended Actions
- Deploy the March 2021 Chrome security update (or later) across all endpoints.
- Verify patch rollout through automated configuration management or vulnerability‑scanning tools; capture screenshots or logs as audit evidence.
- Update browser hardening baselines (disable unnecessary media codecs, enforce site isolation) and map these changes to your control framework.
- Record remediation steps in your risk‑management system to demonstrate continuous control monitoring.
Source: https://nvd.nist.gov/vuln/detail/CVE-2020-6572