CVE-2020-16044: 
Node.js vulnerability analysis and mitigation

Use after free vulnerability (CVE-2020-16044) was discovered in WebRTC component of Google Chrome versions prior to 88.0.4324.96. The vulnerability was discovered by Ned Williamson of Project Zero and disclosed in January 2021. The issue affects the WebRTC implementation's handling of SCTP packets, specifically in relation to COOKIE-ECHO chunks (Mozilla Advisory, Chrome Release).

The vulnerability is a use-after-free condition that occurs when handling malicious COOKIE-ECHO SCTP chunks in WebRTC. The issue received a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified under CWE-416 (Use After Free) and CWE-787 (Out-of-bounds Write) (NVD).

A malicious attacker could potentially exploit heap corruption through this vulnerability via a crafted SCTP packet. With sufficient effort, this could lead to arbitrary code execution. The vulnerability affects the confidentiality, integrity, and availability of the system, all rated as High in the CVSS scoring (NVD).

The vulnerability requires network access and user interaction to exploit. While the attack complexity is considered Low, successful exploitation would require crafting specific SCTP packets to trigger the use-after-free condition (Mozilla Advisory).

The vulnerability was patched in Google Chrome version 88.0.4324.96. Users are advised to update their browsers to this version or later. The fix was also implemented in Firefox 84.0.2 and Firefox ESR 78.6.1 (Mozilla Advisory, Chrome Release).