CVE-2020-16002: 
Google Chrome vulnerability analysis and mitigation

CVE-2020-16002 is a Use-after-free vulnerability discovered in PDFium component of Google Chrome prior to version 86.0.4240.111. The vulnerability was reported by Weipeng Jiang from Codesafe Team of Legendsec at Qi'anxin Group on October 13, 2020 (Chrome Release).

The vulnerability is classified as a Use-after-free (CWE-416) and Out-of-bounds Write (CWE-787) issue in the PDFium component. It has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating that it is network exploitable with low attack complexity, requires no privileges but does need user interaction (NVD).

If successfully exploited, this vulnerability could allow a remote attacker to potentially exploit heap corruption via a crafted PDF file, potentially leading to arbitrary code execution with the same privileges as the Chrome browser process (NVD).

The vulnerability requires user interaction in the form of opening a specially crafted PDF file. The attack can be initiated remotely, and no special privileges are required to exploit it (NVD).

The vulnerability was fixed in Google Chrome version 86.0.4240.111. Users and administrators are advised to upgrade to this version or later. The fix has been backported to various Linux distributions including Fedora, Debian, and Ubuntu (Fedora Update, Debian Security).