How do you patch or mitigate CVE-2020-6572 (Google Chrome Media Use-After-Free)?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

CISA's required action for CVE-2020-6572 is to apply updates per vendor instructions. In practice, find every instance of Google Chrome Media in your estate, apply the vendor security update or documented mitigation, and if no fix can be applied, remove internet exposure or take the product out of service. After patching, review logs for signs of earlier exploitation, because attackers used this flaw in the wild.

What CVE-2020-6572 means operationally

CVE-2020-6572 is a memory-safety flaw in Google Chrome Media, so the practical problem is not just “apply a patch,” but whether Chrome instances are still exposed long enough for exploitation to matter. Treat it as an endpoint browser issue first: inventory the affected browser build across user workstations, VDI images, and managed endpoints, then confirm that the vendor update path is actually reaching all channels and fleets.

When a browser weakness is already confirmed as exploited in the wild, remediation has to be fast and complete. If you cannot update immediately, the fallback is to reduce exposure by removing internet access to the vulnerable instance or taking it out of service until the fix is in place.

What to do when patching is delayed or incomplete

The safest mitigation path is to reduce the attack surface around the browser rather than trying to “compensate” with monitoring alone. That means limiting who can run the affected browser version, preventing unmanaged copies from persisting on the network, and making sure users are not able to keep using an unpatched build through shadow installations, portable copies, or stale images.

Where the browser is embedded in a larger workflow, the operational question is whether you can temporarily reroute users to a supported browser build or isolate the vulnerable host until the vendor update is verified. If the product cannot be updated on a specific system, the correct response is to remove its internet-facing role, not to assume that a policy exception is low risk.

For browser-centric exposure management, NHIMG’s Enterprise Browser and Browser Security Guide is useful because it covers browser hardening, extension control, isolation, and the controls that reduce the impact of browser compromise.

How to confirm you are clean after remediation

After the update or mitigation is in place, check for signs that the flaw may already have been used before you patched it. Focus on browser telemetry, endpoint logs, unusual downloads, unexpected process launches from the browser context, and any indicators of suspicious browsing behavior around the remediation window.

That review matters because patching closes the door, but it does not prove the attacker never walked through it. If you find evidence of exploitation, expand the investigation to adjacent accounts, sessions, and endpoints that shared the same browsing environment or accessed the same content.

The broader issue is browser weakness management, not just a single CVE. NHIMG’s Vulnerability Management Guide is relevant here because it frames exposure triage, exception handling, verification, and remediation tracking in a way that fits actively exploited issues.

Risk and Threat Considerations

This flaw matters because browser media components sit on a common user-facing attack path, and any externally reachable browser instance can become a delivery point for code execution or follow-on compromise. The main risk is not theoretical exposure, it is the combination of wide deployment, frequent user interaction, and active exploitation pressure.

Failure mechanism: A use-after-free in browser media processing can let crafted content corrupt memory during normal page handling, which is why simply having a patched policy on paper is not enough if stale binaries remain in circulation.

Impact: Successful exploitation can expose the endpoint, user session, and anything reachable from that browser context, so delayed remediation increases both compromise likelihood and the amount of post-exploitation cleanup required.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	CVE remediation requires finding and fixing vulnerable Chrome instances quickly.
Recommendation — Track vulnerable Chrome instances and verify remediation until exposure is closed.
NIST CSF 2.0	PR.IP-12 — Vulnerability Management	This CVE is handled through patching, mitigation, and remediation verification.
Recommendation — Apply vulnerability-management processes to patch, mitigate, and verify closure of the Chrome flaw.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The issue is a software flaw requiring vendor updates or approved mitigation.
Recommendation — Use flaw-remediation controls to deploy the vendor fix and track exceptions until closure.
MITRE ATT&CK	T1203 — Exploitation for Client Execution	Exploitation in a browser client can lead to code execution from malicious content.
Recommendation — Hunt for client-execution indicators and validate whether browser activity preceded compromise.

Practitioner Guidance

What to prioritise: Start with asset discovery and version confirmation before you debate compensating controls. The fastest way to miss this class of issue is to assume that “Chrome is managed” means every instance is already fixed.

What to verify: Confirm that the vendor update or documented mitigation has landed on every managed endpoint, including cloned images, remote desktops, and any machine that may have bypassed central software distribution. If a system cannot be brought into compliance quickly, treat removal from service as the safer choice.

Practitioner takeaway: For an exploited browser CVE, the key decision is whether you can prove complete fleet coverage quickly enough to avoid relying on exposure reduction as a long-term substitute for remediation.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org