CVE-2020-15999VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2020-15999: Google Chrome FreeType Heap Buffer Overflow Vulnerability

Affects Google Chrome FreeTypeSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 11/17/2021
EPSS: 63.9% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2020-15999 (opens in a new tab)

Description

CVE-2020-15999 is a heap buffer overflow vulnerability in the FreeType library used by Google Chrome to render fonts. The flaw exists in the Load_SBit_Png function when processing PNG images embedded in fonts. This vulnerability has been exploited in the wild and is part of an exploit chain with other vulnerabilities affecting Windows and Android platforms.

Summary

Google Chrome's use of the FreeType open-source library for font rendering contains a heap buffer overflow vulnerability in the Load_SBit_Png function. This vulnerability occurs during the processing of PNG images embedded within fonts. It is known to be exploited in the wild and is linked as part of an exploit chain with CVE-2020-17087 on Windows and CVE-2020-16010 on Android. The vulnerability is identified as CWE-787 (Out-of-bounds Write).

Impact

Successful exploitation of this heap buffer overflow can lead to memory corruption, potentially allowing an attacker to execute arbitrary code within the context of the Chrome process. This can compromise the security of the affected system. The vulnerability has been observed in active exploitation campaigns.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no explicit patch or remediation information is provided, users and administrators should monitor official Google Chrome security advisories for updates and apply patches promptly once available.

Weaknesses

CWE-787Out-of-bounds Write (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:26:26 UTC

Weaknesses

References

Related threats