Use after free in CefSharp

CRITICAL 9.6EXPLOITED (CISA KEV)CVE-2020-16017 · GHSA-gvqv-779r-4jgp · Published 08/01/2021 · updated 17/06/2026

Google Chrome Use-After-Free Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 03/11/2021. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
CefSharp.Common NuGet	`< 86.0.241`	`86.0.241`
CefSharp.WinForms NuGet	`< 86.0.241`	`86.0.241`
CefSharp.Wpf NuGet	`< 86.0.241`	`86.0.241`
CefSharp.Wpf.HwndHost NuGet	`< 86.0.241`	`86.0.241`
chrome google	`< 86.0.4240.198`	`86.0.4240.198`

Description

CVE-2020-16017: Use after free in site isolation

Google is aware of reports that exploits for CVE-2020-16013 and CVE-2020-16017 exist in the wild.

There is currently little to no public information on the issue other than it has been flagged as High severity.

NVD description

Use after free in site isolation in Google Chrome prior to 86.0.4240.198 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

References

cefsharp/CefSharp security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2020-16017 · ADVISORY
chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_11.html · WEB
crbug.com/1146709 · WEB
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2020-16017

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free