Actively exploited in the wild
Google Chrome for Android UI Heap Buffer Overflow Vulnerability
Google - Chrome for Android UI · Listed in the CISA KEV since 2021-11-03. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2020-16010
CriticalCVSS 9.6KEVSummary
Heap buffer overflow in the UI of Google Chrome on Android prior to 86.0.4240.185. A remote attacker who had compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page.
Risk Assessment
A browser sandbox escape may allow an attacker to execute code outside the isolated renderer process, significantly increasing the risk of full compromise of the user's device.
Recommendation
Update Google Chrome on Android to version 86.0.4240.185 or later. In corporate environments, enforce browser updates on mobile devices.
Other vulnerabilities in Google Chrome
See all- CVE-2026-93387Unknown
Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. The vulnerability was rated High severity by Chromium.
- CVE-2026-93386Unknown
UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. The vulnerability was rated Low severity by Chromium.
- CVE-2026-93385Unknown
Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain sensitive information via a crafted HTML page. The vulnerability was rated Medium severity by Chromium.
- CVE-2026-93384Unknown
Server-side request forgery in Omnibox in Google Chrome on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. The vulnerability was rated Medium severity by Chromium.
- CVE-2026-93383Unknown
Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability was rated Medium severity by Chromium.
- CVE-2026-93382Unknown
Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability was rated High severity by Chromium.
- CVE-2026-93381Unknown
Buffer overflow in PDFium in Google Chrome on Windows prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted PDF file. The vulnerability was rated High severity by Chromium.
- CVE-2026-93380Unknown
Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. The vulnerability was rated Medium severity by Chromium.
- CVE-2026-93379Unknown
Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. The vulnerability was rated High severity by Chromium.
- CVE-2026-93378Unknown
Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. The vulnerability was rated Medium severity by Chromium.
Original NVD description (English source)
Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.