Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
8.8
CVE-2020-6518: Chromium developer tools can be misused to run malicious code
CVE-2020-6518 · published 6 years ago
Summary
Older versions of Chromium’s developer tools may let a specially crafted web page cause memory errors when the tools are open, potentially allowing an attacker to run unwanted code. This risk only applies if a user has the developer tools active while viewing the malicious page. Upgrade Chromium to version 84.0.4147.89 or newer to eliminate the problem.
What to do
- Update debian chromium to version 87.0.4280.88-0.1.
- Update google chrome to version 84.0.4147.89 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | chromium |
< 87.0.4280.88-0.1 Fix: upgrade to 87.0.4280.88-0.1
|
| Debian:13 | debian | chromium |
< 87.0.4280.88-0.1 Fix: upgrade to 87.0.4280.88-0.1
|
| Debian:14 | debian | chromium |
< 87.0.4280.88-0.1 Fix: upgrade to 87.0.4280.88-0.1
|
| – | chrome |
< 84.0.4147.89 cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* |
|
| – | debian | debian_linux |
10.0 cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
31 32 cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* |
| – | opensuse | leap |
15.1 15.2 cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:* |
| – | opensuse | backports_sle |
15.0 cpe:2.3:a:opensuse:backports_sle:15.0:sp2:*:*:*:*:*:* |
Original advisory text
Use after free in developer tools in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had convinced the user to use developer tools to potentially exploit heap corruption via a cra...
Use after free in developer tools in Google Chrome prior to 84.0.4147.89 allowed a remote attacker who had convinced the user to use developer tools to potentially exploit heap corruption via a crafted HTML page.
References
- https://security-tracker.debian.org/tracker/CVE-2020-6518 Vendor Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00069.html Mailing List Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00007.html Mailing List Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-08/msg00018.html Mailing List Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00041.html Mailing List Third Party Advisory
- https://chromereleases.googleblog.com/2020/07/stable-channel-update-for-desktop.... Release Notes Vendor Advisory
- https://crbug.com/986051 Vendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...
- https://security.gentoo.org/glsa/202007-08 Third Party Advisory
- https://security.gentoo.org/glsa/202101-30 Third Party Advisory
- https://www.debian.org/security/2021/dsa-4824 Third Party Advisory
Severity
8.8
High
Type
CWE-416Use After Free
CWE-787Out-of-bounds Write
Timeline
Published22 Jul 2020
Updated30 Oct 2026
First seen11 Sep 2026
Track software like this
Free during beta