CVE-2020-6418

ENISA EUVD: EUVD-2020-27568 ↗

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 5, 2026 3 articles

VulnLookup ↗ NVD ↗ EUVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

86.44%

probability

This CVE has a 86.44% probability of being exploited in the next 30 days.

0% Top 99.4th percentile of all CVEs 100%

CVSS v3.1

Source: NVD

8.8

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

Project Zero

Type confusion in v8

Affected Products

Attack Intelligence

CWE-664 · Improper Control of a Resource Through its Lifetime CWE-704 · Incorrect Type Conversion CWE-843 · Type Confusion

Google Project Zero

Discovered

Feb. 18, 2020

Patched

Feb. 24, 2020

Reported by

Clement Lecigne of Google's Threat Analysis Group

Root Cause Analysis

https://googleprojectzero.github.io/0days-in-the-wild/0day-RCAs/2020/CVE-2020-6418.html

Exploits & PoC

Goyotan/CVE-2020-6418-PoC

for 供養

ulexec/ChromeSHELFLoader

An exploit for CVE-2020-6418 implementing a SHELF Loader. Published as part of Tmp.0ut volume 2

2 repos — triés par ⭐ Rechercher sur GitHub ↗

Install Latest Chrome Update to Patch 0-Day Bug Under Active Attacks

TheHackerNews

Google discloses hacking campaign targeting Windows, Android users

BleepingComputer Jan 13, 2021

Hacking group used 11 zero-days to attack Windows, iOS, Android users

BleepingComputer Mar 20, 2021

Signal Intelligence

Confidenceⓘ

95%

EPSS 86.44%

CVSS v3.1 8.8

Mentions 3

Last Seen Mar 20, 2021

CNA Information

Analyst Note

Auto-imported from Google Project Zero — confirmed zero-day by definition.