CVE-2020-15999

9.6 criticalKEVEPSS 64%

Critical (9.6) in Google Chrome FreeType. In CISA KEV since 2021-11-03. EPSS 64% chance of exploitation in the next 30 days.

Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Severity

CVSS 3.1

9.6 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS: 64% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CISA KEV: listed 2021-11-03, due 2021-11-17
CWEs: CWE-787, CWE-120
Published: 2020-11-03
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

debian:debian_linux
fedoraproject:fedora
freetype:freetype
google:chrome
netapp:ontap_select_deploy_administration_utility
opensuse:backports_sle

References

http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00016.html
http://seclists.org/fulldisclosure/2020/Nov/33
https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html
https://crbug.com/1139963
https://googleprojectzero.blogspot.com/p/rca-cve-2020-15999.html

Check your stack JSON