CVE-2020-6572

What is Chrome's Media Component?

Chrome's media pipeline handles decoding and rendering audio and video content embedded in web pages — a large, complex piece of native code that processes untrusted, attacker-controllable input (media files and streams) by design, making it a recurring source of memory-safety vulnerabilities across every major browser.

Overview

CVE-2020-6572 is a use-after-free vulnerability (CWE-416) in Chrome's Media component. A specially crafted HTML page that triggers the flaw can cause the browser to access memory that has already been freed, and a successful exploit can lead to remote code execution in the context of the browser renderer process (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) — requiring only that a victim visit a malicious or compromised web page.

Technical Details

Use-after-free bugs occur when a program continues to use a pointer to memory after that memory has been deallocated; if an attacker can control what gets reallocated into that freed memory region, they can often manipulate program execution. In Chrome's media handling code, exploitation typically involves careful manipulation of media object lifecycle (creating, destroying, and referencing decoder or renderer objects) via JavaScript to set up the freed-memory condition, then triggering a use of the dangling pointer.

Discovery

Fixed as part of a routine Chrome stable channel security update; Google credits external researchers through its Vulnerability Reward Program for many Chrome memory-safety fixes of this era, though specific individual attribution for this CVE is not highlighted in the release notes.

Exploitation Context

CISA added this CVE to KEV in January 2022 based on confirmed exploitation. Chrome use-after-free vulnerabilities in media and rendering components have historically been a common building block in both commodity drive-by exploit kits and more targeted browser-exploitation chains, given how directly they can be triggered by a victim simply loading a web page.

Remediation

1. Update Chrome (and any Chromium-based browser) to the latest version — browser updates for security fixes of this kind are typically automatic, but verify via chrome://settings/help.
2. Enable Site Isolation and keep it enabled (default in modern Chrome) as defense-in-depth against renderer-process memory-safety bugs.
3. Avoid disabling browser auto-update mechanisms in managed enterprise environments — timely patching of browser memory-safety bugs is one of the highest-leverage security controls available given how frequently these vulnerabilities are found and exploited.
4. Treat any unpatched, older Chrome installation as a live exploitation risk, particularly on systems where browsing to untrusted external sites is possible.