CVE-2020-16016: 
Google Chrome vulnerability analysis and mitigation

CVE-2020-16016 is a security vulnerability discovered in Google Chrome versions prior to 86.0.4240.193. The vulnerability stems from an inappropriate implementation in the base component of Chrome that could allow a remote attacker who has compromised the renderer process to potentially perform a sandbox escape through a crafted HTML page (NVD, Chrome Release).

The vulnerability has been assigned a CVSS v3.1 base score of 9.6 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H. This indicates that the vulnerability can be exploited remotely with low attack complexity, requires no privileges but does need user interaction, and can result in high impacts to confidentiality, integrity, and availability. The vulnerability was reported by Rong Jian and Leecraso of 360 Alpha Lab on November 7, 2020 (NVD, Chrome Release).

The vulnerability allows an attacker who has already compromised the renderer process to potentially escape the Chrome sandbox environment through a specially crafted HTML page. This sandbox escape capability could lead to broader system access and compromise (NVD).

The vulnerability requires the attacker to first compromise the renderer process and then use a crafted HTML page to execute the sandbox escape. The attack requires user interaction but has low complexity in terms of execution (NVD).

Google addressed this vulnerability in Chrome version 86.0.4240.193. Users and administrators are advised to update to this version or later to mitigate the risk. After installing the update, Chrome must be restarted for the changes to take effect (Chrome Release, Red Hat).