CVE-2020-6572: Google Chrome Media Use-After-Free Vulnerability

CVE-2020-6572 is a use-after-free vulnerability in Google Chrome Media. A remote attacker can exploit it by luring a user to a crafted HTML page, which can lead to code execution in the browser context. For IT and security teams this matters because Chrome is widely deployed on endpoints; successful exploitation can give an attacker a foothold on the user’s system without needing prior access.

Public detail is limited to the CISA description and the CWE classification. Confirm exact affected builds, fixed releases, and any additional constraints against the vendor advisory before acting.

How it works

The weakness is CWE-416 (use-after-free). In this class of flaw, the application frees a block of memory but later continues to use a pointer to that memory. An attacker who can influence allocation and free timing—here via a crafted HTML page that exercises Chrome’s media handling—may be able to reuse the freed region with attacker-controlled data. That can corrupt program state and, in a browser renderer or related media component, escalate to arbitrary code execution.

No exploit mechanics, proof-of-concept details, or specific media APIs are provided in the available facts. Treat the attack surface as any untrusted web content that reaches Chrome’s media processing path, and verify the precise trigger conditions in the vendor advisory.

Am I affected? How to find it in your systems

Google Chrome is typically installed on user workstations, VDI images, and some kiosk or shared systems. Inventory every managed and unmanaged endpoint that runs Chrome, including any enterprise-managed channels or secondary browsers that embed Chromium media components if your environment uses them.

• Collect browser version strings from endpoint management tools, software inventory, or scripts that query Chrome’s about/version data.
• Compare collected versions against the fixed releases listed in the vendor advisory; do not assume a version range from secondary sources.
• Note configurations that increase exposure: users who browse untrusted sites, lack of automatic updates, or delayed enterprise update rings.
• For exploitation signs, review endpoint detection telemetry for unexpected Chrome child processes, crashes in media-related modules, or anomalous network activity following visits to suspicious pages. Browser crash reports and EDR process trees can help, but there is no unique public indicator of compromise specified for this CVE—treat anomalies as leads and confirm with vendor and threat-intel guidance.

How to remediate

Patch first. Apply the Chrome updates specified by the vendor, following CISA’s required action: apply updates per vendor instructions. Use your standard enterprise deployment path (auto-update, managed update policies, or packaged rollout) and verify that endpoints actually reach the fixed build.

• Prioritize systems that handle high-risk browsing or privileged users.
• After patching, confirm version compliance across the estate and remediate stragglers.
• For this vulnerability class, keep browser auto-updates enabled where policy allows, restrict unnecessary media or plugin surfaces if the vendor documents such options, and maintain least-privilege user accounts so a browser compromise has limited impact.
• Ensure EDR and browser security features (site isolation, sandboxing) remain enabled; they are general defenses against use-after-free exploitation in renderers.

If you can't patch immediately

Reduce risk with compensating controls until the vendor update is deployed everywhere.

• Segment high-risk users or lab systems and limit their ability to reach untrusted web content.
• Use web filtering or a secure web gateway to block known malicious or uncategorized sites that could host crafted HTML.
• If a WAF or browser isolation solution is in place, apply virtual patching or isolation policies for web content that exercises media playback; confirm rule coverage with your vendor.
• Temporarily harden browsing policy: disable unnecessary media features only if supported and documented by Chrome enterprise policy, and enforce stricter download and site permissions.
• Increase monitoring on Chrome processes for crashes, unusual module loads, and outbound connections after media-heavy page loads. Retain browser and EDR logs for retrospective hunting.

These steps do not eliminate the vulnerability; they only lower likelihood and impact until patches are applied.

If your data may have been exposed

Actively exploited browser code-execution flaws can lead to endpoint compromise and subsequent data theft. Known ransomware use is not documented for this CVE. If you suspect exploitation, isolate affected hosts, preserve volatile evidence, rotate credentials accessible from those systems, and follow your incident-response process. You can run a free exposure scan of your email addresses against known breach data to check whether credentials or personal data have appeared in prior breaches while you complete containment and recovery.