CefSharp.Common

.NET (WPF and Windows Forms) bindings for the Chromium Embedded Framework

View on Nuget

View on Github

Activity

Latest release: 2w ago
Total releases: 193
Cadence: ~19 days
Last 12 months: 17

Reach

Stars: 10.3k

Details

First release: Oct 27, 2014

Releases

Version	Released
`151.3.240` patch	Aug 29, 2026
`151.3.170` major	Aug 16, 2026
`144.0.300` patch 1 CVE	Jul 21, 2026
`150.0.110` major	Jul 18, 2026
`149.0.60` patch	Jun 30, 2026
`149.0.40` major	Jun 21, 2026
`144.0.270` patch 1 CVE	Jun 10, 2026
`144.0.260` patch 1 CVE	Jun 06, 2026
`148.0.90` major	May 29, 2026
`144.0.250` patch 1 CVE	May 23, 2026
`147.0.100` major 1 CVE	May 03, 2026
`146.0.100` patch 1 CVE	Apr 10, 2026
`146.0.70` major 1 CVE	Mar 29, 2026
`145.0.260` major 1 CVE	Feb 22, 2026
`144.0.120` major 1 CVE	Jan 31, 2026
`143.0.90` major 1 CVE	Dec 12, 2025
`141.0.110` major 1 CVE	Oct 25, 2025
`140.1.140` major 1 CVE	Sep 24, 2025
`139.0.280` major 1 CVE	Aug 23, 2025
`138.0.340` patch 1 CVE	Aug 03, 2025
`138.0.170` major 1 CVE	Jul 10, 2025
`137.0.100` major 1 CVE	Jun 06, 2025
`136.1.40` major 1 CVE	May 13, 2025
`135.0.220` patch 1 CVE	Apr 27, 2025
`135.0.170` major 1 CVE	Apr 08, 2025
`134.3.90` patch 1 CVE	Mar 31, 2025
`134.3.60` major 1 CVE	Mar 23, 2025
`133.4.21` major 1 CVE	Feb 24, 2025
`132.3.11` major 1 CVE	Feb 01, 2025
`131.3.50` patch 1 CVE	Dec 23, 2024
`131.3.10` minor 1 CVE	Dec 11, 2024
`131.2.70` major 1 CVE	Nov 23, 2024
`130.1.90` major 1 CVE	Oct 30, 2024
`129.0.110` major 1 CVE	Oct 07, 2024
`128.4.90` major 1 CVE	Sep 21, 2024
`127.3.50` major 1 CVE	Aug 21, 2024
`126.2.180` patch 1 CVE	Jul 19, 2024
`126.2.70` major 1 CVE	Jun 23, 2024
`125.0.210` major 1 CVE	Jun 09, 2024
`124.3.80` patch 1 CVE	May 17, 2024
`124.3.50` patch 1 CVE	May 08, 2024
`124.3.20` major 1 CVE	May 05, 2024
`123.0.60` major 1 CVE	Mar 24, 2024
`122.1.120` major 1 CVE	Mar 13, 2024
`121.3.130` patch 1 CVE	Feb 24, 2024
`121.3.70` major 1 CVE	Feb 09, 2024
`120.2.70` patch 1 CVE	Jan 20, 2024
`120.2.50` minor 1 CVE	Jan 13, 2024
`120.1.110` patch 1 CVE	Dec 24, 2023
`120.1.80` major 1 CVE	Dec 16, 2023

1–50 of 193

Repository

cefsharp/cefsharp

Forks: 2.9k
Open issues: 59
Language: C#

cefsharp
c-sharp
c-plus-plus
wpf
winforms
browser

Dependencies (2)

Depends on

151.3.240

Used by

Supply-chain exposure

52 tracked projects depend on this, <1% of every package we track.

A known CVE here directly exposes every one of them.

Known CVEs (8)

CVE-2026-48796 GHSA-85jm-cwp2-mvpv Jun 30, 2026

CefSharp.Common: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder

5.3 / 10
Medium
Network High None Required Unchanged High None None

Summary

FolderSchemeHandlerFactory was intended to restrict served files to a configured rootFolder, but its path validation used a raw string prefix check. A request could escape to a sibling directory whose full path starts with the root folder path, allowing files outside the configured root to be served.

Details

In affected versions, FolderSchemeHandlerFactory canonicalized rootFolder, decoded the request path, combined it with the root, and then allowed the file when:

filePath.StartsWith(rootFolder, StringComparison.OrdinalIgnoreCase)

This does not enforce a directory boundary. For example, /tmp/app/www2/secret.txt starts with /tmp/app/www, but www2 is a sibling of www, not a child. The same issue applies on Windows, for example C:\app\www2\secret.txt starts with C:\app\www.

The affected code was reviewed at commit b5fef3bb4bc58798c95170078c41de92cfe9066e, assembly version 147.0.100.

PoC

Set rootFolder to a directory named www and create a sibling directory named www2:

<temp>/www/index.html <temp>/www2/secret.txt

Register FolderSchemeHandlerFactory for <temp>/www, then request:

https://folderschemehandlerfactory.test/..%2fwww2/secret.txt

The request path is URL-decoded to ../www2/secret.txt, combined with <temp>/www, and canonicalized to:

<temp>/www2/secret.txt

Because <temp>/www2/secret.txt starts with <temp>/www as a string prefix, the affected check passes and secret.txt is served from outside rootFolder.

Expected vulnerable result: HTTP 200 with the contents of <temp>/www2/secret.txt.

Expected fixed result: 404 or equivalent not-found response because the resolved file is outside rootFolder.

Impact

Applications using FolderSchemeHandlerFactory for a custom scheme or registered HTTP/HTTPS scheme may expose local files outside the intended served directory. This is most relevant when sensitive sibling directories share the root path prefix, such as www/www2, public/public_backup, or static/static-secrets.

An attacker must be able to cause the embedded browser to request URLs handled by the affected scheme registration.

Affected versions

100.0.120-pre100.0.140100.0.230101.0.150101.0.180102.0.100102.0.90103.0.120103.0.80103.0.90104.4.180104.4.240

+ 206 more Show less

105.3.330105.3.390106.0.260106.0.290107.1.120107.1.40107.1.50107.1.90108.4.130109.1.110110.0.250110.0.280110.0.300111.2.20111.2.70112.2.70112.3.0113.1.40113.3.50114.2.100114.2.120115.3.110115.3.130116.0.130116.0.150116.0.190116.0.230117.2.20117.2.40118.6.80119.1.20119.4.30120.1.110120.1.80120.2.50120.2.70121.3.130121.3.70122.1.120123.0.60124.3.20124.3.50124.3.80125.0.210126.2.180126.2.70127.3.50128.4.90129.0.110130.1.90131.2.70131.3.10131.3.50132.3.11133.4.21134.3.60134.3.90135.0.170135.0.220136.1.40137.0.100138.0.170138.0.340139.0.280140.1.140141.0.110143.0.90144.0.120144.0.250144.0.260144.0.270144.0.300145.0.260146.0.100146.0.70147.0.10031.0.0-pre133.0.033.0.233.1.0-pre0137.0.037.0.0-pre0137.0.0-pre0237.0.137.0.237.0.339.0.039.0.0-pre0139.0.0-pre0239.0.0-pre0339.0.139.0.241.0.041.0.0-pre0141.0.143.0.043.0.0-pre0143.0.0-pre0243.0.145.0.045.0.0-pre0147.0.047.0.0-pre0147.0.147.0.247.0.347.0.449.0.049.0.0-pre0149.0.0-pre0249.0.151.0.051.0.0-pre0151.0.0-pre0253.0.053.0.0-pre0153.0.155.0.055.0.0-pre0157.0.057.0.0-pre0162.0.0-pre0162.0.0-proprietary-codecs62.0.0-proprietary-codecs263.0.063.0.0-pre0163.0.0-pre0263.0.0-pre0363.0.163.0.263.0.365.0.065.0.0-pre0165.0.0-pre0265.0.167.0.067.0.0-pre0169.0.069.0.0-pre0171.0.071.0.0-pre0171.0.171.0.273.1.120-pre0173.1.13075.1.140-pre0175.1.14175.1.14275.1.14379.1.310-pre79.1.35079.1.36081.3.10081.3.20-pre83.3.120-pre83.4.2084.3.10-pre84.4.1085.3.120-pre85.3.12185.3.121-pre85.3.13086.0.240-pre86.0.24187.1.130-pre87.1.131-pre87.1.13288.2.40-pre88.2.9089.0.140-pre89.0.17090.5.70-pre90.6.5090.6.7091.1.16091.1.21091.1.21191.1.23091.1.60-pre92.0.250-pre92.0.25192.0.26093.1.110-pre93.1.11193.1.14094.3.0-pre94.4.11094.4.2094.4.5095.7.140-pre95.7.14196.0.140-pre96.0.14196.0.14296.0.17096.0.18097.1.10-pre97.1.1197.1.1297.1.6097.1.6198.1.19098.1.21099.2.12099.2.14099.2.90

Fixed in

148.0.90

References

https://github.com/cefsharp/CefSharp/security/advisories/GHSA-85jm-cwp2-mvpv
https://github.com/cefsharp/CefSharp

Updated Sep 10, 2026 · Source: OSV.dev
GHSA-4c29-gfrp-g6x9 Oct 05, 2023

CefSharp affected by libvpx's heap buffer overflow in vp8 encoding

High

Google is aware that an exploit for CVE-2023-5217 exists in the wild.

Description Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

References

https://www.cve.org/CVERecord?id=CVE-2023-5217

https://nvd.nist.gov/vuln/detail/CVE-2023-5217

Affected versions

100.0.120-pre100.0.140100.0.230101.0.150101.0.180102.0.100102.0.90103.0.120103.0.80103.0.90104.4.180104.4.240

+ 157 more Show less

105.3.330105.3.390106.0.260106.0.290107.1.120107.1.40107.1.50107.1.90108.4.130109.1.110110.0.250110.0.280110.0.300111.2.20111.2.70112.2.70112.3.0113.1.40113.3.50114.2.100114.2.120115.3.110115.3.130116.0.130116.0.150116.0.190116.0.23031.0.0-pre133.0.033.0.233.1.0-pre0137.0.037.0.0-pre0137.0.0-pre0237.0.137.0.237.0.339.0.039.0.0-pre0139.0.0-pre0239.0.0-pre0339.0.139.0.241.0.041.0.0-pre0141.0.143.0.043.0.0-pre0143.0.0-pre0243.0.145.0.045.0.0-pre0147.0.047.0.0-pre0147.0.147.0.247.0.347.0.449.0.049.0.0-pre0149.0.0-pre0249.0.151.0.051.0.0-pre0151.0.0-pre0253.0.053.0.0-pre0153.0.155.0.055.0.0-pre0157.0.057.0.0-pre0162.0.0-pre0162.0.0-proprietary-codecs62.0.0-proprietary-codecs263.0.063.0.0-pre0163.0.0-pre0263.0.0-pre0363.0.163.0.263.0.365.0.065.0.0-pre0165.0.0-pre0265.0.167.0.067.0.0-pre0169.0.069.0.0-pre0171.0.071.0.0-pre0171.0.171.0.273.1.120-pre0173.1.13075.1.140-pre0175.1.14175.1.14275.1.14379.1.310-pre79.1.35079.1.36081.3.10081.3.20-pre83.3.120-pre83.4.2084.3.10-pre84.4.1085.3.120-pre85.3.12185.3.121-pre85.3.13086.0.240-pre86.0.24187.1.130-pre87.1.131-pre87.1.13288.2.40-pre88.2.9089.0.140-pre89.0.17090.5.70-pre90.6.5090.6.7091.1.16091.1.21091.1.21191.1.23091.1.60-pre92.0.250-pre92.0.25192.0.26093.1.110-pre93.1.11193.1.14094.3.0-pre94.4.11094.4.2094.4.5095.7.140-pre95.7.14196.0.140-pre96.0.14196.0.14296.0.17096.0.18097.1.10-pre97.1.1197.1.1297.1.6097.1.6198.1.19098.1.21099.2.12099.2.14099.2.90

Fixed in

117.2.20

References

https://github.com/cefsharp/CefSharp/security/advisories/GHSA-4c29-gfrp-g6x9
https://github.com/cefsharp/CefSharp/commit/45e66f7c0f9094f2fd81ab57b37a9ed9576b51b8
https://github.com/cefsharp/CefSharp

Updated Nov 30, 2024 · Source: OSV.dev
GHSA-j646-gj5p-p45g Sep 21, 2023

CefSharp affected by heap buffer overflow in WebP

Critical

Google is aware that an exploit for CVE-2023-4863 exists in the wild.

Description

Heap buffer overflow in WebP in Google Chrome prior to 116.0.5845.187 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page. (Chromium security severity: Critical)

References

https://www.cve.org/CVERecord?id=CVE-2023-4863

https://nvd.nist.gov/vuln/detail/CVE-2023-4863

https://www.techtarget.com/searchsecurity/news/366551978/Browser-companies-patch-critical-zero-day-vulnerability

Updated

There is another related security vulnerability.

There's another related CVE (CVE-2023-5217) that is fixed in Chromium 117.0.5938.132. This one is triggered by WebCodecs API encoder usage, so a workaround for older versions is to disable the WebCodecs API (--disable-blink-features=WebCodecs).

As per https://magpcss.org/ceforum/viewtopic.php?f=6&t=19551#p54150

Affected versions

100.0.120-pre100.0.140100.0.230101.0.150101.0.180102.0.100102.0.90103.0.120103.0.80103.0.90104.4.180104.4.240

+ 156 more Show less

105.3.330105.3.390106.0.260106.0.290107.1.120107.1.40107.1.50107.1.90108.4.130109.1.110110.0.250110.0.280110.0.300111.2.20111.2.70112.2.70112.3.0113.1.40113.3.50114.2.100114.2.120115.3.110115.3.130116.0.130116.0.150116.0.19031.0.0-pre133.0.033.0.233.1.0-pre0137.0.037.0.0-pre0137.0.0-pre0237.0.137.0.237.0.339.0.039.0.0-pre0139.0.0-pre0239.0.0-pre0339.0.139.0.241.0.041.0.0-pre0141.0.143.0.043.0.0-pre0143.0.0-pre0243.0.145.0.045.0.0-pre0147.0.047.0.0-pre0147.0.147.0.247.0.347.0.449.0.049.0.0-pre0149.0.0-pre0249.0.151.0.051.0.0-pre0151.0.0-pre0253.0.053.0.0-pre0153.0.155.0.055.0.0-pre0157.0.057.0.0-pre0162.0.0-pre0162.0.0-proprietary-codecs62.0.0-proprietary-codecs263.0.063.0.0-pre0163.0.0-pre0263.0.0-pre0363.0.163.0.263.0.365.0.065.0.0-pre0165.0.0-pre0265.0.167.0.067.0.0-pre0169.0.069.0.0-pre0171.0.071.0.0-pre0171.0.171.0.273.1.120-pre0173.1.13075.1.140-pre0175.1.14175.1.14275.1.14379.1.310-pre79.1.35079.1.36081.3.10081.3.20-pre83.3.120-pre83.4.2084.3.10-pre84.4.1085.3.120-pre85.3.12185.3.121-pre85.3.13086.0.240-pre86.0.24187.1.130-pre87.1.131-pre87.1.13288.2.40-pre88.2.9089.0.140-pre89.0.17090.5.70-pre90.6.5090.6.7091.1.16091.1.21091.1.21191.1.23091.1.60-pre92.0.250-pre92.0.25192.0.26093.1.110-pre93.1.11193.1.14094.3.0-pre94.4.11094.4.2094.4.5095.7.140-pre95.7.14196.0.140-pre96.0.14196.0.14296.0.17096.0.18097.1.10-pre97.1.1197.1.1297.1.6097.1.6198.1.19098.1.21099.2.12099.2.14099.2.90

Fixed in

116.0.230

References

https://github.com/cefsharp/CefSharp/security/advisories/GHSA-j646-gj5p-p45g
https://github.com/cefsharp/CefSharp/commit/f2890ba66170afb0bf742839febe4d20449f758c
https://github.com/cefsharp/CefSharp
https://github.com/cefsharp/CefSharp/releases/tag/v116.0.230

Updated Dec 07, 2024 · Source: OSV.dev
CVE-2022-0609 GHSA-vv6j-ww6x-54gx Feb 22, 2022

Use after free in Animation

8.8 / 10
High
Network Low None Required Unchanged High High High

CVE-2022-0609: Use after free in Animation

https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0609

Google is aware of reports that exploits for CVE-2022-0609 exist in the wild.

The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. It demands that the victim is doing some kind of user interaction. Technical details are unknown but an exploit is available.

There is currently little other public information on the issue other than it has been flagged as High severity.

Affected versions

31.0.0-pre133.0.033.0.233.1.0-pre0137.0.037.0.0-pre0137.0.0-pre0237.0.137.0.237.0.339.0.039.0.0-pre01

+ 114 more Show less

39.0.0-pre0239.0.0-pre0339.0.139.0.241.0.041.0.0-pre0141.0.143.0.043.0.0-pre0143.0.0-pre0243.0.145.0.045.0.0-pre0147.0.047.0.0-pre0147.0.147.0.247.0.347.0.449.0.049.0.0-pre0149.0.0-pre0249.0.151.0.051.0.0-pre0151.0.0-pre0253.0.053.0.0-pre0153.0.155.0.055.0.0-pre0157.0.057.0.0-pre0162.0.0-pre0162.0.0-proprietary-codecs62.0.0-proprietary-codecs263.0.063.0.0-pre0163.0.0-pre0263.0.0-pre0363.0.163.0.263.0.365.0.065.0.0-pre0165.0.0-pre0265.0.167.0.067.0.0-pre0169.0.069.0.0-pre0171.0.071.0.0-pre0171.0.171.0.273.1.120-pre0173.1.13075.1.140-pre0175.1.14175.1.14275.1.14379.1.310-pre79.1.35079.1.36081.3.10081.3.20-pre83.3.120-pre83.4.2084.3.10-pre84.4.1085.3.120-pre85.3.12185.3.121-pre85.3.13086.0.240-pre86.0.24187.1.130-pre87.1.131-pre87.1.13288.2.40-pre88.2.9089.0.140-pre89.0.17090.5.70-pre90.6.5090.6.7091.1.16091.1.21091.1.21191.1.23091.1.60-pre92.0.250-pre92.0.25192.0.26093.1.110-pre93.1.11193.1.14094.3.0-pre94.4.11094.4.2094.4.5095.7.140-pre95.7.14196.0.140-pre96.0.14196.0.14296.0.17096.0.18097.1.10-pre97.1.1197.1.1297.1.6097.1.6198.1.190

Fixed in

98.1.210

References

https://github.com/cefsharp/CefSharp/security/advisories/GHSA-vv6j-ww6x-54gx
https://nvd.nist.gov/vuln/detail/CVE-2022-0609
https://chromereleases.googleblog.com/2022/02/stable-channel-update-for-desktop_14.html
https://crbug.com/1296150
https://github.com/cefsharp/CefSharp

Updated Nov 08, 2023 · Source: OSV.dev
CVE-2020-16009 GHSA-m7mf-48hp-5qmr Dec 02, 2020

Inappropriate implementation in V8

8.8 / 10
High
Network Low None Required Unchanged High High High

CVE-2020-16009: Inappropriate implementation in V8

https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16009

Google is aware of reports that exploits for CVE-2020-16009 exist in the wild.

Allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

There is currently little to no public information on the issue other than it has been flagged as High severity.

Affected versions

31.0.0-pre133.0.033.0.233.1.0-pre0137.0.037.0.0-pre0137.0.0-pre0237.0.137.0.237.0.339.0.039.0.0-pre01

+ 75 more Show less

39.0.0-pre0239.0.0-pre0339.0.139.0.241.0.041.0.0-pre0141.0.143.0.043.0.0-pre0143.0.0-pre0243.0.145.0.045.0.0-pre0147.0.047.0.0-pre0147.0.147.0.247.0.347.0.449.0.049.0.0-pre0149.0.0-pre0249.0.151.0.051.0.0-pre0151.0.0-pre0253.0.053.0.0-pre0153.0.155.0.055.0.0-pre0157.0.057.0.0-pre0162.0.0-pre0162.0.0-proprietary-codecs62.0.0-proprietary-codecs263.0.063.0.0-pre0163.0.0-pre0263.0.0-pre0363.0.163.0.263.0.365.0.065.0.0-pre0165.0.0-pre0265.0.167.0.067.0.0-pre0169.0.069.0.0-pre0171.0.071.0.0-pre0171.0.171.0.273.1.120-pre0173.1.13075.1.140-pre0175.1.14175.1.14275.1.14379.1.310-pre79.1.35079.1.36081.3.10081.3.20-pre83.3.120-pre83.4.2084.3.10-pre84.4.1085.3.120-pre85.3.12185.3.121-pre85.3.13086.0.240-pre

Fixed in

86.0.241

References

https://github.com/cefsharp/CefSharp/security/advisories/GHSA-m7mf-48hp-5qmr
https://nvd.nist.gov/vuln/detail/CVE-2020-16009
https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop.html
https://crbug.com/1143772
https://github.com/cefsharp/CefSharp
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/S4XYJ7B6OXHZNYSA5J3DBUOFEC6WCAGW

Updated Feb 16, 2024 · Source: OSV.dev
CVE-2020-16017 GHSA-gvqv-779r-4jgp Nov 27, 2020

Use after free in CefSharp

High

CVE-2020-16017: Use after free in site isolation

https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_11.html

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16017

Google is aware of reports that exploits for CVE-2020-16013 and CVE-2020-16017 exist in the wild.

There is currently little to no public information on the issue other than it has been flagged as High severity.

Affected versions

31.0.0-pre133.0.033.0.233.1.0-pre0137.0.037.0.0-pre0137.0.0-pre0237.0.137.0.237.0.339.0.039.0.0-pre01

+ 75 more Show less

39.0.0-pre0239.0.0-pre0339.0.139.0.241.0.041.0.0-pre0141.0.143.0.043.0.0-pre0143.0.0-pre0243.0.145.0.045.0.0-pre0147.0.047.0.0-pre0147.0.147.0.247.0.347.0.449.0.049.0.0-pre0149.0.0-pre0249.0.151.0.051.0.0-pre0151.0.0-pre0253.0.053.0.0-pre0153.0.155.0.055.0.0-pre0157.0.057.0.0-pre0162.0.0-pre0162.0.0-proprietary-codecs62.0.0-proprietary-codecs263.0.063.0.0-pre0163.0.0-pre0263.0.0-pre0363.0.163.0.263.0.365.0.065.0.0-pre0165.0.0-pre0265.0.167.0.067.0.0-pre0169.0.069.0.0-pre0171.0.071.0.0-pre0171.0.171.0.273.1.120-pre0173.1.13075.1.140-pre0175.1.14175.1.14275.1.14379.1.310-pre79.1.35079.1.36081.3.10081.3.20-pre83.3.120-pre83.4.2084.3.10-pre84.4.1085.3.120-pre85.3.12185.3.121-pre85.3.13086.0.240-pre

Fixed in

86.0.241

References

https://github.com/cefsharp/CefSharp/security/advisories/GHSA-gvqv-779r-4jgp
https://nvd.nist.gov/vuln/detail/CVE-2020-16017
https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_11.html
https://crbug.com/1146709

Updated Dec 02, 2024 · Source: OSV.dev
CVE-2020-16013 GHSA-x7fx-mcc9-27j7 Nov 27, 2020

Inappropriate implementation in V8 in CefSharp

High

High CVE-2020-16013: Inappropriate implementation in V8.

https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_11.html

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16013

Google is aware of reports that exploits for CVE-2020-16013 and CVE-2020-16017 exist in the wild.

There is currently little to no public information on the issue other than it has been flagged as High severity.

Affected versions

31.0.0-pre133.0.033.0.233.1.0-pre0137.0.037.0.0-pre0137.0.0-pre0237.0.137.0.237.0.339.0.039.0.0-pre01

+ 75 more Show less

39.0.0-pre0239.0.0-pre0339.0.139.0.241.0.041.0.0-pre0141.0.143.0.043.0.0-pre0143.0.0-pre0243.0.145.0.045.0.0-pre0147.0.047.0.0-pre0147.0.147.0.247.0.347.0.449.0.049.0.0-pre0149.0.0-pre0249.0.151.0.051.0.0-pre0151.0.0-pre0253.0.053.0.0-pre0153.0.155.0.055.0.0-pre0157.0.057.0.0-pre0162.0.0-pre0162.0.0-proprietary-codecs62.0.0-proprietary-codecs263.0.063.0.0-pre0163.0.0-pre0263.0.0-pre0363.0.163.0.263.0.365.0.065.0.0-pre0165.0.0-pre0265.0.167.0.067.0.0-pre0169.0.069.0.0-pre0171.0.071.0.0-pre0171.0.171.0.273.1.120-pre0173.1.13075.1.140-pre0175.1.14175.1.14275.1.14379.1.310-pre79.1.35079.1.36081.3.10081.3.20-pre83.3.120-pre83.4.2084.3.10-pre84.4.1085.3.120-pre85.3.12185.3.121-pre85.3.13086.0.240-pre

Fixed in

86.0.241

References

https://github.com/cefsharp/CefSharp/security/advisories/GHSA-x7fx-mcc9-27j7
https://nvd.nist.gov/vuln/detail/CVE-2020-16013
https://chromereleases.googleblog.com/2020/11/stable-channel-update-for-desktop_11.html
https://crbug.com/1147206

Updated Dec 02, 2024 · Source: OSV.dev
CVE-2020-15999 GHSA-pv36-h7jh-qm62 A-171232105 ASB-A-171232105 Oct 27, 2020

Heap buffer overflow in CefSharp

6.5 / 10
Medium
Network Low None Required Unchanged None None High

Impact

A memory corruption bug(Heap overflow) in the FreeType font rendering library.

This can be exploited by attackers to execute arbitrary code by using specially crafted fonts with embedded PNG images .

As per https://www.secpod.com/blog/chrome-zero-day-under-active-exploitation-patch-now/

Google is aware of reports that an exploit for CVE-2020-15999 exists in the wild.

Patches

Upgrade to 85.3.130 or higher

References

https://www.secpod.com/blog/chrome-zero-day-under-active-exploitation-patch-now/

https://www.zdnet.com/article/google-releases-chrome-security-update-to-patch-actively-exploited-zero-day/

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15999

https://magpcss.org/ceforum/viewtopic.php?f=10&t=17942

To review the CEF/Chromium patch see https://bitbucket.org/chromiumembedded/cef/commits/cd6cbe008b127990036945fb75e7c2c1594ab10d

Affected versions

31.0.0-pre133.0.033.0.233.1.0-pre0137.0.037.0.0-pre0137.0.0-pre0237.0.137.0.237.0.339.0.039.0.0-pre01

+ 73 more Show less

39.0.0-pre0239.0.0-pre0339.0.139.0.241.0.041.0.0-pre0141.0.143.0.043.0.0-pre0143.0.0-pre0243.0.145.0.045.0.0-pre0147.0.047.0.0-pre0147.0.147.0.247.0.347.0.449.0.049.0.0-pre0149.0.0-pre0249.0.151.0.051.0.0-pre0151.0.0-pre0253.0.053.0.0-pre0153.0.155.0.055.0.0-pre0157.0.057.0.0-pre0162.0.0-pre0162.0.0-proprietary-codecs62.0.0-proprietary-codecs263.0.063.0.0-pre0163.0.0-pre0263.0.0-pre0363.0.163.0.263.0.365.0.065.0.0-pre0165.0.0-pre0265.0.167.0.067.0.0-pre0169.0.069.0.0-pre0171.0.071.0.0-pre0171.0.171.0.273.1.120-pre0173.1.13075.1.140-pre0175.1.14175.1.14275.1.14379.1.310-pre79.1.35079.1.36081.3.10081.3.20-pre83.3.120-pre83.4.2084.3.10-pre84.4.1085.3.120-pre85.3.12185.3.121-pre

Fixed in

85.3.130

References

https://github.com/cefsharp/CefSharp/security/advisories/GHSA-pv36-h7jh-qm62
https://nvd.nist.gov/vuln/detail/CVE-2020-15999
https://www.nuget.org/packages/CefSharp.Wpf.HwndHost
https://www.nuget.org/packages/CefSharp.Wpf
https://www.nuget.org/packages/CefSharp.WinForms
https://www.nuget.org/packages/CefSharp.Common

Updated Feb 03, 2025 · Source: OSV.dev

Insights

Releases per month

last 12 months

Release mix

major 88
minor 5
patch 76
pre 23

193 releases

Dependencies over time

per release

Release calendar

2026

Jan

Feb

Mar

Apr

May

Jun

Jul

Aug

Sep

Oct

Nov

Dec

Less More