CVE-2020-15976
📋 TL;DR
This is a use-after-free vulnerability in WebXR (Extended Reality) implementation in Google Chrome on Android. It allows a remote attacker to potentially exploit heap corruption and execute arbitrary code by tricking users into visiting a malicious HTML page. Only Android users running Chrome versions before 86.0.4240.75 are affected.
💻 Affected Systems
- Google Chrome
📦 What is this software?
Backports Sle by Opensuse
Chrome by Google
Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...
Learn more about Chrome →Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete device compromise, data theft, or installation of persistent malware.
Likely Case
Browser crash (denial of service) or limited memory corruption that could be leveraged for information disclosure.
If Mitigated
No impact if Chrome is updated to patched version or if WebXR is disabled.
🎯 Exploit Status
Exploitation requires crafting malicious WebXR content and convincing user to visit page. No public exploit code is known.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 86.0.4240.75 and later
Vendor Advisory: https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html
Restart Required: Yes
Instructions:
1. Open Chrome on Android. 2. Go to Settings > About Chrome. 3. Chrome will automatically check for updates. 4. If update 86.0.4240.75 or later is available, install it. 5. Restart Chrome after installation.
🔧 Temporary Workarounds
Disable WebXR
androidDisable WebXR experimental feature in Chrome flags to prevent exploitation.
chrome://flags/#webxr
Set 'WebXR Device API' to 'Disabled'
🧯 If You Can't Patch
- Disable WebXR via chrome://flags as temporary mitigation.
- Use alternative browser without WebXR support until Chrome can be updated.
🔍 How to Verify
Check if Vulnerable:
Check Chrome version: Open Chrome > Settings > About Chrome. If version is below 86.0.4240.75, device is vulnerable.Check Version:
chrome://versionVerify Fix Applied:
Confirm Chrome version is 86.0.4240.75 or higher after update.📡 Detection & Monitoring
Log Indicators:
- Chrome crash logs referencing WebXR or memory corruption
- Unexpected WebXR API calls in developer console logs
Network Indicators:
- HTTP requests to domains hosting WebXR content with suspicious patterns
- Increased traffic to WebXR-related resources
SIEM Query:
source="chrome_crash_logs" AND (message="*WebXR*" OR message="*use-after-free*" OR message="*heap corruption*")🔗 References
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html
- https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html
- https://crbug.com/1123522
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/24QFL4C3AZKMFVL7LVSYMU2DNE5VVUGS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GWCWNHTTYOH6HSFUXPGPBB6J6JYZHZE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M/
- https://security.gentoo.org/glsa/202101-30
- https://www.debian.org/security/2021/dsa-4824
- http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html
- https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop.html
- https://crbug.com/1123522
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/24QFL4C3AZKMFVL7LVSYMU2DNE5VVUGS/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GWCWNHTTYOH6HSFUXPGPBB6J6JYZHZE/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SC3U3H6AISVZB5PLZLLNF4HMQ4UFFL7M/
- https://security.gentoo.org/glsa/202101-30
- https://www.debian.org/security/2021/dsa-4824
