CVE-2020-6460: 
Node.js vulnerability analysis and mitigation

Insufficient data validation in URL formatting in Google Chrome prior to 81.0.4044.122 allowed a remote attacker to perform domain spoofing via a crafted domain name (Chrome Blog, NVD). The vulnerability was discovered on March 21, 2020, and was patched in Chrome version 81.0.4044.122.

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (Medium), with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. This indicates that the vulnerability can be exploited remotely with low attack complexity, requires no privileges but does require user interaction, has no impact on confidentiality or availability, but can have a high impact on integrity (NVD).

The vulnerability allows an attacker to perform domain spoofing through crafted domain names, which could potentially mislead users about the authenticity of websites they visit. This could lead to phishing attacks or other forms of web-based deception (NVD).

The vulnerability requires user interaction and can be exploited remotely with low attack complexity. Google awarded a $15,000 bounty for this vulnerability, indicating its significant security impact (Chrome Blog).

The vulnerability was fixed in Chrome version 81.0.4044.122. Users should update their Chrome browser to this version or later to mitigate the risk. The fix was also backported to various Linux distributions, including Debian and Ubuntu (Debian Security).