CVE-2020-16010VulnerabilityPublished 11/03/2021Updated 10/24/2026

CVE-2020-16010: Google Chrome for Android UI Heap Buffer Overflow Vulnerability

Affects Google Chrome for Android UISource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 11/03/2021
KEV deadline: 05/03/2022
EPSS: 6.4% chance of exploitation in 30 days – higher than 93% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

nvd.nist.gov/vuln/detail/CVE-2020-16010 (opens in a new tab)

Description

CVE-2020-16010 is a heap buffer overflow vulnerability in the Google Chrome for Android UI. It allows a remote attacker who has compromised the renderer process to potentially escape the sandbox by using a crafted HTML page. This vulnerability has been exploited in the wild. No specific affected versions or patch information is provided in the input data.

Summary

Google Chrome for Android UI contains a heap buffer overflow vulnerability (CWE-787) that can be triggered by a crafted HTML page. An attacker who has already compromised the renderer process may exploit this flaw to perform a sandbox escape, potentially increasing their privileges or access on the device. The vulnerability has been observed in active exploitation scenarios. No vendor advisory or patch information is included in the provided data.

Impact

The vulnerability enables a remote attacker, with control over the renderer process, to escape the sandbox environment. This could lead to elevated privileges or unauthorized actions beyond the browser sandbox on affected Android devices running Google Chrome. Exploitation has been confirmed in the wild, indicating active threat usage.

Mitigation

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when browsing untrusted web content on Chrome for Android and consider applying any available updates from Google promptly once released.

Weaknesses

CWE-787Out-of-bounds Write (opens in a new tab)

What to do

Description

AnalysisAI-generated, updated 10/24/2026, 09:26:29 UTC

Weaknesses

References

Related threats