CVE-2020-6560: 
Google Chrome vulnerability analysis and mitigation

CVE-2020-6560 is a security vulnerability discovered in Google Chrome prior to version 85.0.4183.83. The vulnerability stems from insufficient policy enforcement in the browser's autofill feature, which could allow a remote attacker to leak cross-origin data through a crafted HTML page (Chrome Blog, NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 6.5 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. This indicates that the vulnerability is network-exploitable, requires low attack complexity, needs no privileges, but does require user interaction. The impact primarily affects confidentiality, with no impact on integrity or availability (NVD).

The vulnerability allows an attacker to potentially leak cross-origin data, which could lead to unauthorized access to sensitive information from other origins. This cross-origin data leak could compromise user privacy and security by exposing information that should be protected by same-origin policy restrictions (Chrome Blog).

The vulnerability requires user interaction and can be exploited remotely through a specially crafted HTML page. The exploit was reported by Nadja Ungethuem from www.unnex.de on 2020-07-22, and Google awarded a $5,000 bounty for the discovery (Chrome Blog).

The vulnerability was patched in Google Chrome version 85.0.4183.83. Users and administrators are advised to upgrade to this version or later to mitigate the risk. The fix was subsequently incorporated into various Linux distributions including Debian, Fedora, and OpenSUSE through their respective security updates (Debian Advisory, Fedora Update).