CVE-2020-16012: 
NixOS vulnerability analysis and mitigation

Side-channel information leakage in graphics in Google Chrome prior to version 87.0.4280.66 allowed a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability, identified as CVE-2020-16012, was discovered by Aleksejs Popovs and disclosed in November 2020 (Chrome Release).

When drawing a transparent image on top of an unknown cross-origin image, the Skia library drawImage function took a variable amount of time depending on the content of the underlying image. This timing variation resulted in potential cross-origin information exposure of image content through timing side-channel attacks. The vulnerability has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N (Mozilla Advisory, NVD).

The vulnerability could allow remote attackers to leak cross-origin data through timing side-channel attacks. The impact is primarily focused on confidentiality, with the potential for information disclosure of image content across origin boundaries (NVD).

The vulnerability requires user interaction and can be exploited remotely through a crafted HTML page. The attack complexity is considered low, requiring no special privileges for exploitation (Ubuntu Advisory).

The vulnerability was fixed in Google Chrome version 87.0.4280.66. Users are advised to update to this version or later. Firefox addressed this issue in version 83.0 and Firefox ESR 78.5, while Thunderbird fixed it in version 78.5.0 (Mozilla Advisory).