CVE-2020-16027: 
Google Chrome vulnerability analysis and mitigation

Insufficient policy enforcement in developer tools in Google Chrome prior to version 87.0.4280.66 was identified as CVE-2020-16027. The vulnerability allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from the user's disk via a crafted Chrome Extension (Chrome Release, NVD).

The vulnerability was assigned a CVSS v3.1 base score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges, but does require user interaction. The vulnerability was classified under CWE-862: Missing Authorization (NVD).

The vulnerability could allow attackers to access potentially sensitive information from the user's disk when exploited successfully through a malicious Chrome extension. The impact is primarily focused on confidentiality, with no direct impact on integrity or availability of the system (NVD).

The vulnerability requires user interaction in the form of installing a malicious extension. The exploit can be triggered remotely but needs the user to be convinced to install the malicious extension first (NVD).

Google addressed this vulnerability in Chrome version 87.0.4280.66. Users should update their Chrome browser to this version or later to mitigate the risk. The fix was released as part of Chrome's stable channel update (Chrome Release).

The vulnerability was reported by David Erceg and was awarded a $5,000 bug bounty through Google's Vulnerability Reward Program (Chrome Release).