CVE-2020-6459: 
Node.js vulnerability analysis and mitigation

Use after free in payments in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. The vulnerability was discovered by Zhe Jin from cdsrc of Qihoo 360 on March 27, 2020, and was assigned CVE-2020-6459. The issue was fixed in Chrome version 81.0.4044.122 for Windows, Mac, and Linux platforms (Chrome Release).

The vulnerability is classified as a Use-After-Free (UAF) issue in the payments system of Google Chrome. It received a CVSS v3.1 Base Score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is associated with CWE-416 (Use After Free) and CWE-787 (Out-of-bounds Write) (NVD).

The vulnerability could allow a remote attacker to potentially exploit heap corruption through a specially crafted HTML page, potentially leading to arbitrary code execution. Given the high CVSS score and the critical nature of payment systems, successful exploitation could lead to significant security breaches including information disclosure, system compromise, and potential financial fraud (NVD).

The vulnerability requires user interaction with a maliciously crafted HTML page to be exploited. The attacker needs no special privileges, and the attack complexity is considered low according to the CVSS metrics. Google awarded a $20,000 bounty for this vulnerability, indicating its serious nature (Chrome Release).

The vulnerability was patched in Chrome version 81.0.4044.122. Users and administrators should ensure their Chrome installations are updated to this version or later. The fix was also incorporated into various Linux distributions, including Debian which addressed it in version 83.0.4103.116-1~deb10u1 (Debian Advisory).