Live › vulnerability › CVE-2020-15999
Go to dashboardGoogle Chrome bundles the FreeType font library, which has a heap buffer overflow when it parses PNG images embedded in fonts (Load_SBit_Png). An attacker who gets a user to load a crafted font can corrupt memory and may run code, and this flaw was exploited in the wild as part of a chain with CVE-2020-17087 and CVE-2020-16010.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Google Chrome FreeType | vendor | – | – |
Open chrome://version in Chrome and compare the version to the fixed release in the vendor advisory.
Update Google Chrome to a release that includes the FreeType fix, per the vendor instructions CISA references.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Google Chrome uses FreeType, an open-source software library to render fonts, which contains a heap buffer overflow vulnerability in the function Load_SBit_Png when processing PNG images embedded into fonts. This vulnerability is part of an exploit chain with CVE-2020-17087 on Windows and CVE-2020-16010 on Android.
CISA required action: Apply updates per vendor instructions.
This page as .md · .json · in your agent: get_signal("CVE-2020-15999")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.