PHP2Shell: Read our blog on the critical RCE vulnerabilities affecting 70% of the Internet

CVE-2020-16037: 
Node.js vulnerability analysis and mitigation

Overview

CVE-2020-16037 is a high-severity vulnerability discovered in Google Chrome's clipboard functionality. The vulnerability was identified as a Use-After-Free (UAF) issue affecting versions prior to 87.0.4280.88. This security flaw was discovered and reported on October 26, 2020, and was subsequently patched in December 2020 (Chrome Release).

Technical details

The vulnerability is classified as a Use-After-Free (UAF) issue in the clipboard functionality of Google Chrome. It received a CVSS v3.1 base score of 8.8 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is associated with CWE-416 (Use After Free) and CWE-787 (Out-of-bounds Write), indicating potential memory corruption issues (NVD).

Impact

If successfully exploited, this vulnerability could allow a remote attacker to potentially exploit heap corruption through a specially crafted HTML page, potentially leading to arbitrary code execution within the context of the browser (NVD).

Exploitability

The vulnerability requires user interaction and can be exploited remotely through a crafted HTML page. The exploit was awarded a $5,000 bounty, suggesting significant security implications (Chrome Release).

Mitigation and workarounds

The vulnerability was patched in Google Chrome version 87.0.4280.88. Users and administrators should ensure their Chrome installations are updated to this version or later to mitigate the risk (Chrome Release).

Additional resources


Source: This report was generated using AI

Related Node.js vulnerabilities:

CVE ID

Severity

Score

Technologies

Component name

CISA KEV exploit

Has fix

Published date

CVE-2026-106074NONEN/A
  • npm logonpm
  • nodejs
NoYesOct 23, 2026
CVE-2026-106073NONEN/A
  • npm logonpm
  • nodejs
NoYesOct 23, 2026
CVE-2026-106072NONEN/A
  • npm logonpm
  • nodejs-full-i18n
NoYesOct 23, 2026
CVE-2026-106071NONEN/A
  • npm logonpm
  • nodejs24
NoYesOct 23, 2026
CVE-2026-106070NONEN/A
  • npm logonpm
  • nodejs-full-i18n
NoYesOct 23, 2026

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."
David EstlickCISO
"Wiz provides a single pane of glass to see what is going on in our cloud environments."
Adam FletcherChief Security Officer
"We know that if Wiz identifies something as critical, it actually is."
Greg PoniatowskiHead of Threat and Vulnerability Management