CVE-2020-16029: 
Google Chrome vulnerability analysis and mitigation

Inappropriate implementation in PDFium in Google Chrome prior to version 87.0.4280.66 allowed a remote attacker to bypass navigation restrictions via a crafted PDF file. The vulnerability was discovered and reported on October 1, 2020, and was assigned CVE-2020-16029. The issue was fixed with the release of Chrome 87.0.4280.66 for Windows and Linux, and 87.0.4280.67 for Mac (Chrome Release).

The vulnerability received a CVSS v3.1 base score of 8.8 (HIGH), with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-862 (Missing Authorization). The attack vector is network-based, requires low attack complexity, needs no privileges, but does require user interaction. The scope is unchanged, with high impact on confidentiality, integrity, and availability (NVD Database).

The vulnerability could allow an attacker to bypass navigation restrictions when a user interacts with a specially crafted PDF file. Given the high CVSS scores for confidentiality, integrity, and availability, successful exploitation could potentially lead to significant security compromises in the affected systems (NVD Database).

The vulnerability requires user interaction with a malicious PDF file for exploitation. The attack can be executed remotely with low attack complexity and requires no special privileges, making it relatively accessible to potential attackers (NVD Database).

The vulnerability was addressed in Chrome version 87.0.4280.66 for Windows and Linux, and 87.0.4280.67 for Mac. Users should update their Chrome browsers to these versions or later to mitigate the vulnerability. The fix was also backported to various Linux distributions, including Ubuntu 18.04 LTS and 16.04 LTS (Ubuntu Security).

Google awarded a bounty of $3,000 to the anonymous researcher who reported this vulnerability through their bug bounty program (Chrome Release).