CVE-2020-15961
📋 TL;DR
This vulnerability in Google Chrome allowed malicious extensions to bypass security sandbox restrictions. Attackers could convince users to install a crafted extension that would then escape Chrome's sandbox, potentially gaining elevated privileges. All Chrome users with vulnerable versions who install malicious extensions are affected.
💻 Affected Systems
- Google Chrome
📦 What is this software?
Backports Sle by Opensuse
Backports Sle by Opensuse
Chrome by Google
Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...
Learn more about Chrome →Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Leap by Opensuse
Leap by Opensuse
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via sandbox escape allowing arbitrary code execution with elevated privileges, potentially leading to data theft, ransomware deployment, or persistent backdoor installation.
Likely Case
Malicious extension escapes Chrome sandbox to access system resources, install additional malware, or steal sensitive data from the compromised system.
If Mitigated
With proper extension vetting and user education, risk is limited to isolated Chrome process compromise without system-wide impact.
🎯 Exploit Status
Exploitation requires user interaction to install malicious extension. No public exploit code available, but vulnerability is serious enough that attackers likely developed private exploits.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 85.0.4183.121 and later
Vendor Advisory: https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-desktop_21.html
Restart Required: Yes
Instructions:
1. Open Chrome. 2. Click the three-dot menu. 3. Go to Help > About Google Chrome. 4. Chrome will automatically check for and install updates. 5. Click 'Relaunch' to restart Chrome with the patched version.
🔧 Temporary Workarounds
Disable extension installation
allPrevent users from installing any Chrome extensions to block the attack vector.
For enterprise: Use Group Policy to disable extension installation via ExtensionInstallBlocklist policy set to *
Restrict extension sources
allOnly allow extensions from Chrome Web Store to reduce risk of malicious extensions.
For enterprise: Use ExtensionInstallSources policy to restrict installation sources
🧯 If You Can't Patch
- Implement strict extension whitelisting policies to only allow vetted extensions
- Educate users about the risks of installing extensions from untrusted sources
🔍 How to Verify
Check if Vulnerable:
Check Chrome version: If version is less than 85.0.4183.121, system is vulnerable.Check Version:
On Chrome: chrome://version/ or in terminal: google-chrome --versionVerify Fix Applied:
Verify Chrome version is 85.0.4183.121 or higher after update.📡 Detection & Monitoring
Log Indicators:
- Unusual extension installation events
- Chrome crash reports with extension-related errors
- Security logs showing sandbox violation attempts
Network Indicators:
- Downloads of extension files (.crx) from untrusted sources
- Connections to known malicious extension repositories
SIEM Query:
source="chrome_logs" AND (event="extension_install" AND source_ip NOT IN trusted_ips) OR (event="sandbox_violation" AND process="chrome")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00087.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00095.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00096.html
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00049.html
- https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-desktop_21.html
- https://crbug.com/1114636
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FN7HZIGAOCZKBT4LV363BCPRA5FLY25I/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GNIYFJST4TFJYFZ27VODBOINCLBGULTD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YWNBJFBPKYCYSZTS54FHNCRZG6KC2AIJ/
- https://security.gentoo.org/glsa/202009-13
- https://security.gentoo.org/glsa/202101-30
- https://www.debian.org/security/2021/dsa-4824
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00087.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00095.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00096.html
- http://lists.opensuse.org/opensuse-security-announce/2020-10/msg00049.html
- https://chromereleases.googleblog.com/2020/09/stable-channel-update-for-desktop_21.html
- https://crbug.com/1114636
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FN7HZIGAOCZKBT4LV363BCPRA5FLY25I/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GNIYFJST4TFJYFZ27VODBOINCLBGULTD/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YWNBJFBPKYCYSZTS54FHNCRZG6KC2AIJ/
- https://security.gentoo.org/glsa/202009-13
- https://security.gentoo.org/glsa/202101-30
- https://www.debian.org/security/2021/dsa-4824
