CVE-2020-16026: 
Google Chrome vulnerability analysis and mitigation

A Use-after-free vulnerability in WebRTC component of Google Chrome (CVE-2020-16026) was discovered prior to version 87.0.4280.66. The vulnerability was reported by Jong-Gwon Kim (kkwon) on October 16, 2020, and was officially patched in the Chrome 87 stable release (Chrome Release).

The vulnerability is classified as a Use-after-free (CWE-416) and Out-of-bounds Write (CWE-787) issue in the WebRTC component. It received a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating a high severity issue that requires user interaction for exploitation (NVD).

The vulnerability could allow a remote attacker to potentially exploit heap corruption through a specially crafted HTML page, potentially leading to arbitrary code execution within the context of the browser (NVD).

The vulnerability requires user interaction to be exploited, specifically through a crafted HTML page. The attacker would need network access and user interaction to successfully exploit this vulnerability (NVD).

Google addressed this vulnerability in Chrome version 87.0.4280.66 for Windows and Linux, and 87.0.4280.67 for Mac. Users are advised to update to these versions or later to mitigate the risk (Chrome Release).

The vulnerability was deemed significant enough to warrant a $7,500 bug bounty reward to the researcher who reported it (Chrome Release).