Skip to content
feed: live
0dayNews
CVE Record
[ HIGH ]CVE-2020-6572

Google Chrome Media Use-After-Free Vulnerability

Google Chrome Media contains a use-after-free vulnerability that allows a remote attacker to execute code via a crafted HTML page.

Vendor
Google
Product
Chrome Media
CVSS
8.8
EPSS (exploit probability)
10.6%
Status
kev
CISA patch-by (BOD 22-01)
Added to KEV

Is CVE-2020-6572 being exploited?

Yes. CISA added CVE-2020-6572 to its Known Exploited Vulnerabilities catalog on . CISA only lists a CVE when it has reliable evidence of exploitation in the wild.

FIRST's EPSS model puts the probability of exploitation activity in the next 30 days at 10.6% (scored October 14, 2026).

Catalog snapshot 2026-10-19. Full cross-catalog view: /kev-comparison

What to do

CISA required actionApply updates per vendor instructions.

US federal civilian agencies must remediate by (181 days after listing) under BOD 22-01. Everyone else: that deadline is a sensible upper bound, not a target. Vendor guidance and the NVD record are linked under Source above.

CVE / VulnerabilitySeverityCVSSEPSSAdded to KEV
CVE-2026-106382
Use-after-free in Chromecast allows sandbox code executionwrite-up
[ CRITICAL ]9.60.4%—
CVE-2026-106358
Use-after-free in Chrome Navigation allows sandbox code executionwrite-up
[ CRITICAL ]9.60.5%—
CVE-2026-106347
Use-after-free in Chrome Track component allows sandbox code executionwrite-up
[ HIGH ]8.80.4%—
CVE-2026-106197
Use-after-free in Chrome Browser component enables sandbox RCEwrite-up
[ CRITICAL ]9.60.5%—
CVE-2026-58704
Google Pixel Cellular Modem Improper Authorizationwrite-up
[ HIGH ]8.80.6%
CVE-2026-87491
Google Chromium V8 Out of Bounds Write Vulnerability
[ HIGH ]8.83.1%
CVE-2026-85046
Type confusion in Chrome V8 allows sandbox code executionwrite-up
[ HIGH ]8.848.9%
CVE-2026-15765
Chrome Ozone use-after-freewrite-up
[ HIGH ]7.50.5%—
All 81 Google CVEs →