CVE-2020-16023: 
Node.js vulnerability analysis and mitigation

Use after free vulnerability (CVE-2020-16023) was discovered in WebCodecs component of Google Chrome versions prior to 87.0.4280.66. The vulnerability was reported on November 7, 2020, and was fixed with the release of Chrome 87.0.4280.66 (Chrome Release).

The vulnerability is classified as a Use-After-Free (UAF) issue in the WebCodecs component that could lead to heap corruption. It received a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is associated with CWE-416 (Use After Free) and CWE-787 (Out-of-bounds Write) (NVD).

If successfully exploited, this vulnerability could allow a remote attacker to achieve high impacts on confidentiality, integrity, and availability of the affected system through heap corruption. The attack requires user interaction and can be triggered via a crafted HTML page (Ubuntu).

The vulnerability requires network access and user interaction to exploit. The attack complexity is considered low, with no privileges required for exploitation. The vulnerability was reported by Brendon Tiszka and David Manouchehri supporting the EFF, and was awarded a significant bounty of $15,000 ($7500+$7500) through Google's bug bounty program (Chrome Release).

The vulnerability was fixed in Google Chrome version 87.0.4280.66. Users should update to this version or later to mitigate the risk. The fix was also backported to various Linux distributions, including Ubuntu 18.04 LTS (87.0.4280.66-0ubuntu0.18.04.1) and Ubuntu 16.04 LTS (87.0.4280.66-0ubuntu0.16.04.1) (Ubuntu).