CVE-2020-6464: 
Node.js vulnerability analysis and mitigation

Type confusion in Blink in Google Chrome prior to 81.0.4044.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. The vulnerability was discovered by Looben Yang and was assigned CVE-2020-6464 (Chrome Blog).

The vulnerability is classified as a Type Confusion vulnerability in the Blink rendering engine of Google Chrome. It received a CVSS v3.1 Base Score of 8.8 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, no privileges required, and user interaction required for exploitation (NVD).

If successfully exploited, this vulnerability could lead to heap corruption, potentially allowing an attacker to execute arbitrary code via a specially crafted HTML page. The high CVSS score indicates severe potential impacts on confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability requires user interaction and can be exploited remotely through a crafted HTML page. A proof-of-concept exploit was reported and tracked under bug ID 1071059 (Chrome Blog).

The vulnerability was patched in Chrome version 81.0.4044.138. Users and administrators are advised to upgrade to this version or later to mitigate the risk. The fix was also backported to various Linux distributions including Debian, Ubuntu, and OpenSUSE (Debian Security, Gentoo Security).