CVE-2020-16015: 
Node.js vulnerability analysis and mitigation

Insufficient data validation in WASM (WebAssembly) in Google Chrome versions prior to 87.0.4280.66 allowed remote attackers to potentially exploit heap corruption through a specially crafted HTML page. The vulnerability was discovered and reported by Rong Jian and Leecraso of 360 Alpha Lab on November 7, 2020, and was patched in the stable channel update released on November 17, 2020 (Chrome Release).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (High), with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. This indicates that the vulnerability can be exploited remotely with low attack complexity, requires no privileges but does need user interaction, and can result in high impacts to confidentiality, integrity, and availability. The vulnerability is associated with multiple CWE classifications including CWE-843 (Access of Resource Using Incompatible Type), CWE-787 (Out-of-bounds Write), and CWE-20 (Improper Input Validation) (NVD).

If successfully exploited, this vulnerability could lead to heap corruption, potentially allowing an attacker to execute arbitrary code within the context of the browser. The high CVSS score indicates serious potential impacts on system confidentiality, integrity, and availability (NVD).

The vulnerability requires user interaction, specifically visiting a maliciously crafted HTML page. The attack vector is network-based, meaning it can be exploited remotely, and requires low attack complexity to execute (NVD).

The vulnerability was fixed in Google Chrome version 87.0.4280.66 for Windows and Linux, and version 87.0.4280.67 for Mac. Users are advised to update to these versions or later to mitigate the vulnerability (Chrome Release).