CVE-2020-6381

Integer overflow in JavaScript in Google Chrome on ChromeOS and Android prior to 80.0.3987.87...

8.8 HighFix available

Integer overflow in JavaScript in Google Chrome on ChromeOS and Android prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.21%Up 1.1 points since Apr 14, 2021

What each source reports

NVD Score used 8.8

Integer overflow in JavaScript in Google Chrome on ChromeOS and Android prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Record: CVE-2020-6381
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0: 6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness: CWE-190
Updated: 2026-11-02

CVE List No score

Integer overflow in JavaScript in Google Chrome on ChromeOS and Android prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Record: CVE-2020-6381
Updated: 2026-11-02

EUVDEUVD-2020-27531 No score

Integer overflow in JavaScript in Google Chrome on ChromeOS and Android prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Record: EUVD-2020-27531
Updated: 2026-11-03

GitHub AdvisoriesGHSA-hjqw-r6v2-ghff 8.8

Integer overflow in JavaScript in Google Chrome on ChromeOS and Android prior to 80.0.3987.87...

Integer overflow in JavaScript in Google Chrome on ChromeOS and Android prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Record: GHSA-hjqw-r6v2-ghff
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-190
Updated: 2026-11-02

OSV 8.8

Integer overflow in JavaScript in Google Chrome on ChromeOS and Android prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Record: CVE-2020-6381
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2020-6381 8.8

Integer overflow in JavaScript in Google Chrome on ChromeOS and Android prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Record: DEBIAN-CVE-2020-6381
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 8 moreShow less

OSVRHSA-2020:0514 8.8

Red Hat Security Advisory: chromium-browser security update

Record: RHSA-2020:0514
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2020-6381 8.8

Integer overflow in JavaScript in Google Chrome on ChromeOS and Android prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Record: UBUNTU-CVE-2020-6381
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVMGASA-2020-0123 No score

Updated chromium-browser-stable packages fix security vulnerabilities

Chromium-browser 80.0.3987.122 fixes security issues:

Multiple flaws were found in the way Chromium 79.0.3945.130 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information. (CVE-2020-6381, CVE-2020-6382, CVE-2020-6383, CVE-2020-6384, CVE-2020-6385, CVE-2020-6386, CVE-2020-6387, CVE-2020-6388, CVE-2020-6389, CVE-2020-6390, CVE-2020-6391, CVE-2020-6392, CVE-2020-6393, CVE-2020-6394, CVE-2020-6395, CVE-2020-6396, CVE-2020-6397, CVE-2020-6398, CVE-2020-6399, CVE-2020-6400, CVE-2020-6401, CVE-2020-6402, CVE-2020-6403, CVE-2020-6404, CVE-2020-6405, CVE-2020-6406, CVE-2020-6407, CVE-2020-6408, CVE-2020-6409, CVE-2020-6410, CVE-2020-6411, CVE-2020-6412, CVE-2020-6413, CVE-2020-6414, CVE-2020-6415, CVE-2020-6416, CVE-2020-6418, CVE-2019-18197, CVE-2019-19923, CVE-2019-19925, CVE-2019-19926)

Upstream chromium 80.0.3987.122 also includes a fix for an integer overflow issue in ICU. Since the chromium-browser-stable package is linked against the icu packages instead of using the ICU source code bundled with chromium upstream, this issue is fixed in the icu package.

Record: MGASA-2020-0123
Updated: 2026-11-02

OSVopenSUSE-SU-2020:0189-1 No score

Security update for chromium

This update for chromium fixes the following issues:

Chromium was updated to version 80.0.3987.87 (boo#1162833).

Security issues fixed:

CVE-2020-6381: Integer overflow in JavaScript (boo#1162833).
CVE-2020-6382: Type Confusion in JavaScript (boo#1162833).
CVE-2019-18197: Multiple vulnerabilities in XML (boo#1162833).
CVE-2019-19926: Inappropriate implementation in SQLite (boo#1162833).
CVE-2020-6385: Insufficient policy enforcement in storage (boo#1162833).
CVE-2019-19880, CVE-2019-19925: Multiple vulnerabilities in SQLite (boo#1162833).
CVE-2020-6387: Out of bounds write in WebRTC (boo#1162833).
CVE-2020-6388: Out of bounds memory access in WebAudio (boo#1162833).
CVE-2020-6389: Out of bounds write in WebRTC (boo#1162833).
CVE-2020-6390: Out of bounds memory access in streams (boo#1162833).
CVE-2020-6391: Insufficient validation of untrusted input in Blink (boo#1162833).
CVE-2020-6392: Insufficient policy enforcement in extensions (boo#1162833).
CVE-2020-6393: Insufficient policy enforcement in Blink (boo#1162833).
CVE-2020-6394: Insufficient policy enforcement in Blink (boo#1162833).
CVE-2020-6395: Out of bounds read in JavaScript (boo#1162833).
CVE-2020-6396: Inappropriate implementation in Skia (boo#1162833).
CVE-2020-6397: Incorrect security UI in sharing (boo#1162833).
CVE-2020-6398: Uninitialized use in PDFium (boo#1162833).
CVE-2020-6399: Insufficient policy enforcement in AppCache (boo#1162833).
CVE-2020-6400: Inappropriate implementation in CORS (boo#1162833).
CVE-2020-6401: Insufficient validation of untrusted input in Omnibox (boo#1162833).
CVE-2020-6402: Insufficient policy enforcement in downloads (boo#1162833).
CVE-2020-6403: Incorrect security UI in Omnibox (boo#1162833).
CVE-2020-6404: Inappropriate implementation in Blink (boo#1162833).
CVE-2020-6405: Out of bounds read in SQLite (boo#1162833).
CVE-2020-6406: Use after free in audio (boo#1162833).
CVE-2019-19923: Out of bounds memory access in SQLite (boo#1162833).
CVE-2020-6408: Insufficient policy enforcement in CORS (boo#1162833).
CVE-2020-6409: Inappropriate implementation in Omnibox (boo#1162833).
CVE-2020-6410: Insufficient policy enforcement in navigation (boo#1162833).
CVE-2020-6411: Insufficient validation of untrusted input in Omnibox (boo#1162833).
CVE-2020-6412: Insufficient validation of untrusted input in Omnibox (boo#1162833).
CVE-2020-6413: Inappropriate implementation in Blink (boo#1162833).
CVE-2020-6414: Insufficient policy enforcement in Safe Browsing (boo#1162833).
CVE-2020-6415: Inappropriate implementation in JavaScript (boo#1162833).
CVE-2020-6416: Insufficient data validation in streams (boo#1162833).
CVE-2020-6417: Inappropriate implementation in installer (boo#1162833).

Record: openSUSE-SU-2020:0189-1
Updated: 2026-11-02

OSVopenSUSE-SU-2020:0210-1 No score

Security update for chromium

This update for chromium fixes the following issues:

Chromium was updated to version 80.0.3987.87 (boo#1162833).

Security issues fixed:

CVE-2020-6381: Integer overflow in JavaScript (boo#1162833).
CVE-2020-6382: Type Confusion in JavaScript (boo#1162833).
CVE-2019-18197: Multiple vulnerabilities in XML (boo#1162833).
CVE-2019-19926: Inappropriate implementation in SQLite (boo#1162833).
CVE-2020-6385: Insufficient policy enforcement in storage (boo#1162833).
CVE-2019-19880, CVE-2019-19925: Multiple vulnerabilities in SQLite (boo#1162833).
CVE-2020-6387: Out of bounds write in WebRTC (boo#1162833).
CVE-2020-6388: Out of bounds memory access in WebAudio (boo#1162833).
CVE-2020-6389: Out of bounds write in WebRTC (boo#1162833).
CVE-2020-6390: Out of bounds memory access in streams (boo#1162833).
CVE-2020-6391: Insufficient validation of untrusted input in Blink (boo#1162833).
CVE-2020-6392: Insufficient policy enforcement in extensions (boo#1162833).
CVE-2020-6393: Insufficient policy enforcement in Blink (boo#1162833).
CVE-2020-6394: Insufficient policy enforcement in Blink (boo#1162833).
CVE-2020-6395: Out of bounds read in JavaScript (boo#1162833).
CVE-2020-6396: Inappropriate implementation in Skia (boo#1162833).
CVE-2020-6397: Incorrect security UI in sharing (boo#1162833).
CVE-2020-6398: Uninitialized use in PDFium (boo#1162833).
CVE-2020-6399: Insufficient policy enforcement in AppCache (boo#1162833).
CVE-2020-6400: Inappropriate implementation in CORS (boo#1162833).
CVE-2020-6401: Insufficient validation of untrusted input in Omnibox (boo#1162833).
CVE-2020-6402: Insufficient policy enforcement in downloads (boo#1162833).
CVE-2020-6403: Incorrect security UI in Omnibox (boo#1162833).
CVE-2020-6404: Inappropriate implementation in Blink (boo#1162833).
CVE-2020-6405: Out of bounds read in SQLite (boo#1162833).
CVE-2020-6406: Use after free in audio (boo#1162833).
CVE-2019-19923: Out of bounds memory access in SQLite (boo#1162833).
CVE-2020-6408: Insufficient policy enforcement in CORS (boo#1162833).
CVE-2020-6409: Inappropriate implementation in Omnibox (boo#1162833).
CVE-2020-6410: Insufficient policy enforcement in navigation (boo#1162833).
CVE-2020-6411: Insufficient validation of untrusted input in Omnibox (boo#1162833).
CVE-2020-6412: Insufficient validation of untrusted input in Omnibox (boo#1162833).
CVE-2020-6413: Inappropriate implementation in Blink (boo#1162833).
CVE-2020-6414: Insufficient policy enforcement in Safe Browsing (boo#1162833).
CVE-2020-6415: Inappropriate implementation in JavaScript (boo#1162833).
CVE-2020-6416: Insufficient data validation in streams (boo#1162833).
CVE-2020-6417: Inappropriate implementation in installer (boo#1162833).

This update was imported from the openSUSE:Leap:15.1:Update update project.

Record: openSUSE-SU-2020:0210-1
Updated: 2026-11-02

OSVopenSUSE-SU-2020:0233-1 No score

Security update for chromium, re2

This update for chromium, re2 fixes the following issues:

Update to 80.0.3987.87 boo#1162833:
- CVE-2020-6381: Integer overflow in JavaScript
- CVE-2020-6382: Type Confusion in JavaScript
- CVE-2019-18197: Multiple vulnerabilities in XML
- CVE-2019-19926: Inappropriate implementation in SQLite
- CVE-2020-6385: Insufficient policy enforcement in storage
- CVE-2019-19880, CVE-2019-19925: Multiple vulnerabilities in SQLite
- CVE-2020-6387: Out of bounds write in WebRTC
- CVE-2020-6388: Out of bounds memory access in WebAudio
- CVE-2020-6389: Out of bounds write in WebRTC
- CVE-2020-6390: Out of bounds memory access in streams
- CVE-2020-6391: Insufficient validation of untrusted input in Blink
- CVE-2020-6392: Insufficient policy enforcement in extensions
- CVE-2020-6393: Insufficient policy enforcement in Blink
- CVE-2020-6394: Insufficient policy enforcement in Blink
- CVE-2020-6395: Out of bounds read in JavaScript
- CVE-2020-6396: Inappropriate implementation in Skia
- CVE-2020-6397: Incorrect security UI in sharing
- CVE-2020-6398: Uninitialized use in PDFium
- CVE-2020-6399: Insufficient policy enforcement in AppCache
- CVE-2020-6400: Inappropriate implementation in CORS
- CVE-2020-6401: Insufficient validation of untrusted input in Omnibox
- CVE-2020-6402: Insufficient policy enforcement in downloads
- CVE-2020-6403: Incorrect security UI in Omnibox
- CVE-2020-6404: Inappropriate implementation in Blink
- CVE-2020-6405: Out of bounds read in SQLite
- CVE-2020-6406: Use after free in audio
- CVE-2019-19923: Out of bounds memory access in SQLite
- CVE-2020-6408: Insufficient policy enforcement in CORS
- CVE-2020-6409: Inappropriate implementation in Omnibox
- CVE-2020-6410: Insufficient policy enforcement in navigation
- CVE-2020-6411: Insufficient validation of untrusted input in Omnibox
- CVE-2020-6412: Insufficient validation of untrusted input in Omnibox
- CVE-2020-6413: Inappropriate implementation in Blink
- CVE-2020-6414: Insufficient policy enforcement in Safe Browsing
- CVE-2020-6415: Inappropriate implementation in JavaScript
- CVE-2020-6416: Insufficient data validation in streams
- CVE-2020-6417: Inappropriate implementation in installer

re2 was updated to fix:

Update to 2020-01-01:

various developer visible changes

Update to 2019-12-01:

fix latent bugs and undefined behavior

Update to 2019-11-01:

new benchmark API

Update to 2019-09-01:

build system fixes

Update to 2019-08-01:

Update Unicode data to 12.1.0
Various developer visible changes

Update to 2019-07-01:

developer visible changes

Record: openSUSE-SU-2020:0233-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10681-1 No score

chromedriver-93.0.4577.82-1.1 on GA media

These are all security issues fixed in the chromedriver-93.0.4577.82-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10681-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:12948-1 No score

ungoogled-chromium-113.0.5672.92-1.1 on GA media

These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:12948-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`chromium` Debian:12	before 80.0.3987.106-1	80.0.3987.106-1
`chromium` Debian:13	before 80.0.3987.106-1	80.0.3987.106-1
`chromium` Debian:14	before 80.0.3987.106-1	80.0.3987.106-1
`chromium` Debian:10 From an advisory covering 46 CVEs	before 80.0.3987.132-1~deb10u1, plus listed versions 73.0.3683.75-174.0.3729.108-175.0.3770.10-175.0.3770.80-175.0.3770.90-1 Show 20 moreShow less 76.0.3809.100-176.0.3809.100-1~deb10u176.0.3809.62-176.0.3809.71-176.0.3809.87-176.0.3809.87-278.0.3904.108-178.0.3904.108-1~deb10u178.0.3904.87-178.0.3904.97-178.0.3904.97-1~deb10u179.0.3945.130-179.0.3945.130-1~deb10u179.0.3945.130-279.0.3945.56-179.0.3945.79-180.0.3987.106-180.0.3987.116-180.0.3987.122-180.0.3987.122-2	80.0.3987.132-1~deb10u1
`chromium-browser-stable` Mageia:7 From an advisory covering 41 CVEs	before 80.0.3987.122-1.mga7	80.0.3987.122-1.mga7
`icu` Mageia:7 From an advisory covering 41 CVEs	before 63.1-1.2.mga7	63.1-1.2.mga7
`chromium-browser` Red Hat:rhel_extras:6 From an advisory covering 42 CVEs	before 0:80.0.3987.87-1.el6_10	0:80.0.3987.87-1.el6_10
`chromium-browser-debuginfo` Red Hat:rhel_extras:6 From an advisory covering 42 CVEs	before 0:80.0.3987.87-1.el6_10	0:80.0.3987.87-1.el6_10
`chromium-browser` Ubuntu:16.04:LTS	before 80.0.3987.87-0ubuntu0.16.04.1, plus listed versions 45.0.2454.101-0ubuntu1.120147.0.2526.73-0ubuntu1.121847.0.2526.106-0ubuntu1.122148.0.2564.82-0ubuntu1.122248.0.2564.116-0ubuntu1.1229 Show 45 moreShow less 49.0.2623.87-0ubuntu1.123249.0.2623.108-0ubuntu1.123350.0.2661.102-0ubuntu0.16.04.1.123751.0.2704.79-0ubuntu0.16.04.1.124252.0.2743.116-0ubuntu0.16.04.1.125053.0.2785.143-0ubuntu0.16.04.1.125453.0.2785.143-0ubuntu0.16.04.1.125755.0.2883.87-0ubuntu0.16.04.126356.0.2924.76-0ubuntu0.16.04.126857.0.2987.98-0ubuntu0.16.04.127658.0.3029.81-0ubuntu0.16.04.127758.0.3029.96-0ubuntu0.16.04.127958.0.3029.110-0ubuntu0.16.04.128159.0.3071.109-0ubuntu0.16.04.128959.0.3071.109-0ubuntu0.16.04.129160.0.3112.78-0ubuntu0.16.04.129360.0.3112.113-0ubuntu0.16.04.129861.0.3163.79-0ubuntu0.16.04.130061.0.3163.100-0ubuntu0.16.04.130662.0.3202.62-0ubuntu0.16.04.130862.0.3202.75-0ubuntu0.16.04.131362.0.3202.89-0ubuntu0.16.04.131562.0.3202.94-0ubuntu0.16.04.131763.0.3239.84-0ubuntu0.16.04.163.0.3239.132-0ubuntu0.16.04.164.0.3282.119-0ubuntu0.16.04.164.0.3282.140-0ubuntu0.16.04.164.0.3282.167-0ubuntu0.16.04.165.0.3325.181-0ubuntu0.16.04.166.0.3359.139-0ubuntu0.16.04.366.0.3359.181-0ubuntu0.16.04.167.0.3396.99-0ubuntu0.16.04.268.0.3440.75-0ubuntu0.16.04.168.0.3440.106-0ubuntu0.16.04.169.0.3497.81-0ubuntu0.16.04.170.0.3538.67-0ubuntu0.16.04.170.0.3538.77-0ubuntu0.16.04.170.0.3538.110-0ubuntu0.16.04.171.0.3578.80-0ubuntu0.16.04.171.0.3578.98-0ubuntu0.16.04.172.0.3626.119-0ubuntu0.16.04.172.0.3626.121-0ubuntu0.16.04.173.0.3683.75-0ubuntu0.16.04.173.0.3683.86-0ubuntu0.16.04.174.0.3729.169-0ubuntu0.16.04.1	80.0.3987.87-0ubuntu0.16.04.1
`chromium-browser` Ubuntu:18.04:LTS	before 80.0.3987.87-0ubuntu0.18.04.1, plus listed versions 61.0.3163.100-0ubuntu1.137862.0.3202.62-0ubuntu0.17.10.138062.0.3202.89-0ubuntu1.138662.0.3202.94-0ubuntu1.138863.0.3239.84-0ubuntu1 Show 32 moreShow less 63.0.3239.108-0ubuntu164.0.3282.119-0ubuntu164.0.3282.140-0ubuntu164.0.3282.167-0ubuntu165.0.3325.146-0ubuntu165.0.3325.181-0ubuntu166.0.3359.139-0ubuntu0.18.04.366.0.3359.181-0ubuntu0.18.04.167.0.3396.99-0ubuntu0.18.04.168.0.3440.75-0ubuntu0.18.04.168.0.3440.106-0ubuntu0.18.04.169.0.3497.81-0ubuntu0.18.04.170.0.3538.67-0ubuntu0.18.04.170.0.3538.77-0ubuntu0.18.04.170.0.3538.110-0ubuntu0.18.04.171.0.3578.80-0ubuntu0.18.04.171.0.3578.98-0ubuntu0.18.04.172.0.3626.119-0ubuntu0.18.04.172.0.3626.121-0ubuntu0.18.04.173.0.3683.75-0ubuntu0.18.04.173.0.3683.86-0ubuntu0.18.04.174.0.3729.169-0ubuntu0.18.04.175.0.3770.90-0ubuntu0.18.04.175.0.3770.142-0ubuntu0.18.04.176.0.3809.87-0ubuntu0.18.04.176.0.3809.100-0ubuntu0.18.04.177.0.3865.90-0ubuntu0.18.04.178.0.3904.70-0ubuntu0.18.04.278.0.3904.97-0ubuntu0.18.04.178.0.3904.108-0ubuntu0.18.04.179.0.3945.79-0ubuntu0.18.04.179.0.3945.130-0ubuntu0.18.04.1	80.0.3987.87-0ubuntu0.18.04.1

Show 8 moreShow less

Affected packages
Package	Affected	Fixed
`chromium` openSUSE:Leap 15.1 From an advisory covering 38 CVEs	before 80.0.3987.87-lp151.2.63.1	80.0.3987.87-lp151.2.63.1
`chromium` SUSE:Package Hub 15 SP1 From an advisory covering 38 CVEs	before 80.0.3987.87-bp151.3.59.1	80.0.3987.87-bp151.3.59.1
`chromium` SUSE:Package Hub 12 From an advisory covering 38 CVEs	before 80.0.3987.87-31.1	80.0.3987.87-31.1
`re2` SUSE:Package Hub 12 From an advisory covering 38 CVEs	before 20200101-25.1	20200101-25.1
`chromium` SUSE:Package Hub 12 SP3 From an advisory covering 38 CVEs	before 80.0.3987.87-31.1	80.0.3987.87-31.1
`re2` SUSE:Package Hub 12 SP3 From an advisory covering 38 CVEs	before 20200101-25.1	20200101-25.1
`chromium` openSUSE:Tumbleweed From an advisory covering 1081 CVEs	before 93.0.4577.82-1.1	93.0.4577.82-1.1
`chromium` openSUSE:Tumbleweed From an advisory covering 2310 CVEs	before 113.0.5672.92-1.1	113.0.5672.92-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-6381 is a high vulnerability (CVSS 8.8) in Google Chrome, published February 8, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.21%, the 82nd percentile. Fixed in chromium 80.0.3987.106-1.

References

Show 194 moreShow less

This page doesn't list everything

Left out here: 8 versions and 2,306 references. The JSON record has them.