CVE-2020-6461: 
Node.js vulnerability analysis and mitigation

CVE-2020-6461 is a high-severity use-after-free vulnerability discovered in the storage component of Google Chrome versions prior to 81.0.4044.129. The vulnerability was reported by Zhe Jin from cdsrc of Qihoo 360 on April 21, 2020, and was patched in the stable channel update released on April 27, 2020 (Chrome Release).

The vulnerability is classified as a use-after-free issue in the storage component of Chrome. It has received a CVSS v3.1 base score of 9.6 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, indicating network attack vector, low attack complexity, no privileges required, user interaction required, changed scope, and high impact on confidentiality, integrity, and availability (NVD).

If successfully exploited, this vulnerability could allow a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. This could lead to arbitrary code execution outside the browser's sandbox environment (NVD).

The vulnerability requires the attacker to first compromise the renderer process and then craft a specific HTML page to trigger the use-after-free condition. The attack requires user interaction but can be executed remotely with no special privileges (NVD).

The vulnerability was fixed in Chrome version 81.0.4044.129. Users and administrators are advised to upgrade to this version or later. Multiple Linux distributions have also released security updates to address this vulnerability, including Red Hat Enterprise Linux, Debian, and Gentoo (Red Hat Advisory, Gentoo Advisory).