CVE-2020-15980: 
Google Chrome vulnerability analysis and mitigation

CVE-2020-15980 is a security vulnerability discovered in Google Chrome on Android prior to version 86.0.4240.75. The vulnerability was identified as an insufficient policy enforcement issue in Intents that allowed a local attacker to bypass navigation restrictions via crafted Intents (NVD, Chrome Blog).

The vulnerability is classified with a CVSS v3.1 Base Score of 7.8 (HIGH), with the vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. This indicates a local attack vector, low attack complexity, low privileges required, no user interaction needed, and high impacts on confidentiality, integrity, and availability (NVD).

The vulnerability could allow a local attacker to bypass navigation restrictions in Google Chrome on Android, potentially compromising the browser's security model and affecting the confidentiality, integrity, and availability of the system (NVD).

The vulnerability requires local access to exploit and was reported by Yongke Wang(@Rudykewang) and Aryb1n(@aryb1n) of Tencent Security Xuanwu Lab. A bounty of $3000 was awarded for this discovery (Chrome Blog).

The vulnerability was fixed in Google Chrome version 86.0.4240.75. Users are advised to update their Chrome browser to this version or later. The fix has been incorporated into various distributions including Fedora, Debian, and OpenSUSE (Debian Security, Fedora Update).