ZeroDay Findings
Sign inSign up

Findings

CVE-2020-15999

Google Chrome FreeType Heap Buffer Overflow Vulnerability

Published Nov 2, 2020 · updated Jun 16, 2026 · google chrome

Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and CVE-2020-16010 on Android.

Timeline

Detection, updates, and resolution for this record.

  1. Nov 2, 2020 · Catalog

    Detected

    Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and CVE-2020-16010 on Android.

  2. Nov 3, 2021 · CISA KEV

    Known exploited

    Apply updates per vendor instructions.

  3. Nov 17, 2021 · CISA KEV

    Remediation due

    Apply updates per vendor instructions.

  4. Jun 16, 2026 · Catalog

    Updated

    Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and CVE-2020-16010 on Android.

Required action

Apply updates per vendor instructions.

CISA due date Nov 17, 2021

Affected

  • cpe debian/debian linux10.0
  • cpe fedoraproject/fedora31
  • cpe freetype/freetypeversion unspecified
  • cpe google/chromeversion unspecified
  • cpe netapp/ontap select deploy administration utilityversion unspecified
  • cpe opensuse/backports sle15.0
  • vendor Google Chrome FreeTypeversion unspecified

Sources

  • CISA KEVCVE-2020-15999

    Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and CVE-2020-16010 on Android.

    cisa.gov
  • CVE.orgCVE-2020-15999

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2020-15999

    30-day exploitation probability 63.9%

    first.org
  • NIST NVDCVE-2020-15999

    Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

    nvd.nist.gov

References

CVE-2020-15999 · ZeroDay Findings