9.6 Critical Exploited

CVE-2020-16010 Google Chrome for Android UI Heap Buffer Overflow Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply updates per vendor instructions.

Ransomware campaigns Not observed so far

Weakness CWE-787

Description

Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Affected products and versions

Product	Affected versions	Fixed in
Chrome 86.0	earliest → < 86.0.4240.185	86.0.4240.185
Android	Versions not published

References

crbug.com crbug.com
chromereleases.googleblog.com chromereleases.googleblog.com

Timeline

Published November 3, 2020
Added to the KEV catalogue November 3, 2021
Last modified January 12, 2026

The 6072 CVEs of Chrome →

CVE-2026-120930 Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web… 5.4 Medium CVE-2026-120931 Out of bounds write in WebGL in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to… 9.6 Critical CVE-2026-121141 Improper input validation in Editing in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social… 5.4 Medium CVE-2026-121195 Incorrect authorization in TrustedTypes in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass… 8.8 High

Track this CVE