BROWSER-CHROME -- Snort has detected suspicious traffic known to exploit vulnerabilities present in the Chrome browser. These rules are separate from the "browser-webkit" category; while it uses the Webkit rendering engine, there's a lot of other features to create a secondary Chrome category.
BROWSER-CHROME Google Chrome Blink Renderer MediaElementEventListener memory corruption attempt
An issue in the Blink third party renderer for Google Chrome can lead to a use after free of a internal object containing the list of valid audio sources. This can lead to a use after free, and from there potential remote code execution.
What To Look For
This rule alerts on an attempt to exploit CVE-2020-6549.
Public information/Proof of Concept available
No known false positives
Cisco Talos Intelligence Group
MITRE ATT&CK Framework
Technique: User Execution
For reference, see the MITRE ATT&CK vulnerability types here:
Use After Free
Use After Free (UAF) attacks target computer memory flaws to corrupt the memory execute code. The name refers to attempts to use memory after it has been freed, which can cause a program to crash under normal circumstances, or result in remote code execution in a successful attack.
CVE Additional Information
CVE-2020-6549Use after free in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
||Ease of Access||LOW