CVE-2020-15974
📋 TL;DR
This integer overflow vulnerability in Chrome's Blink rendering engine allows attackers to bypass site isolation protections. Attackers can craft malicious HTML pages to potentially access cross-origin data. All Chrome users prior to version 86.0.4240.75 are affected.
💻 Affected Systems
- Google Chrome
- Chromium-based browsers
📦 What is this software?
Backports Sle by Opensuse
Chrome by Google
Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...
Learn more about Chrome →Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Complete bypass of Chrome's site isolation security boundary, enabling cross-origin data theft including cookies, session tokens, and sensitive information from other websites.
Likely Case
Targeted attacks against users visiting malicious websites, potentially stealing authentication tokens or sensitive data from other tabs/windows.
If Mitigated
With updated Chrome and proper web security controls, impact is limited to denial of service or minor information leakage.
🎯 Exploit Status
Exploitation requires user interaction (visiting malicious webpage) but no authentication. No public exploit code available at disclosure.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 86.0.4240.75
Vendor Advisory: https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html
Restart Required: Yes
Instructions:
1. Open Chrome menu > Help > About Google Chrome. 2. Chrome will automatically check for updates. 3. If update available, click 'Relaunch' to apply. 4. Verify version is 86.0.4240.75 or later.
🔧 Temporary Workarounds
Disable JavaScript
allTemporarily disable JavaScript to prevent exploitation via crafted HTML pages
chrome://settings/content/javascript
Use Site Isolation Disable Flag
allDisable site isolation feature (not recommended for security)
chrome://flags/#site-isolation-trial-opt-out
🧯 If You Can't Patch
- Use alternative browser with updated security patches
- Implement network filtering to block known malicious domains hosting exploit pages
🔍 How to Verify
Check if Vulnerable:
Check Chrome version via chrome://version or Help > About Google ChromeCheck Version:
google-chrome --versionVerify Fix Applied:
Confirm Chrome version is 86.0.4240.75 or higher📡 Detection & Monitoring
Log Indicators:
- Chrome crash reports with Blink component
- Unusual cross-origin resource access patterns
Network Indicators:
- Requests to domains hosting crafted HTML pages with unusual parameters
SIEM Query:
source="chrome" AND (event_type="crash" AND component="blink") OR (url CONTAINS "malicious_domain_pattern")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html
- https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html
- https://crbug.com/1104103
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/24QFL4C3AZKMFVL7LVSYMU2DNE5VVUGS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GWCWNHTTYOH6HSFUXPGPBB6J6JYZHZE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M/
- https://security.gentoo.org/glsa/202101-30
- https://www.debian.org/security/2021/dsa-4824
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html
- https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html
- https://crbug.com/1104103
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/24QFL4C3AZKMFVL7LVSYMU2DNE5VVUGS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GWCWNHTTYOH6HSFUXPGPBB6J6JYZHZE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M/
- https://security.gentoo.org/glsa/202101-30
- https://www.debian.org/security/2021/dsa-4824
