CVE-2020-15985: 
Google Chrome vulnerability analysis and mitigation

CVE-2020-15985 is a security vulnerability discovered in Google Chrome's Blink engine prior to version 86.0.4240.75. The vulnerability was identified as an inappropriate implementation in Blink that allowed a remote attacker to spoof security UI via a crafted HTML page (NVD). The vulnerability was reported by Abdulrahman Alqabandi from Microsoft Browser Vulnerability Research on June 25, 2020 (Chrome Release).

The vulnerability has been assigned a CVSS v3.1 base score of 6.5 (Medium), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. This indicates that the vulnerability is network exploitable, requires low attack complexity, needs no privileges, requires user interaction, and can result in high impact to integrity (NVD).

The vulnerability allows a remote attacker to spoof security UI elements through a specially crafted HTML page, potentially misleading users about the security status or identity of websites they visit (NVD).

The vulnerability requires user interaction and can be exploited remotely through a crafted HTML page. While technical details about exploitation are limited, the vulnerability was discovered and reported through coordinated vulnerability disclosure (Chrome Release).

The vulnerability was fixed in Google Chrome version 86.0.4240.75. Users and administrators are advised to upgrade to this version or later to mitigate the risk. The fix has been incorporated into various Linux distributions including Fedora, Debian, and Gentoo through their respective security updates (Debian Security, Gentoo Security).