CVE-2020-12387

What it actually does

A race condition when running shutdown code for Web Worker led to a use-after-free vulnerability resulting in a potentially exploitable crash.

Why it matters to the business

Remote attackers could crash the application or achieve code execution, disrupting operations and risking data exposure in affected systems such as the listed voting application; low and stable EPSS with no KEV listing reduces immediate ransomware urgency despite the 2325-day exposure window.

How an attack unfolds

An attacker supplies content that starts a Web Worker, then triggers concurrent shutdown paths to win the race, freeing memory that subsequent code still references to corrupt state and gain control.

How to fix it

Upgrade dbijaya/OnlineVotingSystem (GIT) to commit 0181cb0272857696c8eb3e44fcf6cb014ff90f09; apply equivalent fixes to any vendored Web Worker shutdown logic in downstream dependents.

How to confirm the fix worked

Confirm the commit hash or version string matches the fixed release; re-execute shutdown-heavy test cases under concurrency to verify absence of the race.

Typical attack path

1. Serve or inject content that initializes a Web Worker
2. Force overlapping shutdown and cleanup operations to win the race
3. Trigger use-after-free to corrupt memory or control flow
4. Escalate to arbitrary code execution or denial of service

How to detect it

Review application and browser crash logs for Web Worker shutdown entries around the time of anomalies; correlate with memory corruption indicators in process dumps; no named threat actors are associated with this CVE.

What your security team should do

• Immediately update the affected repository to the listed fixed commit
• Audit any custom Web Worker usage for similar shutdown races
• Monitor EPSS trend and add the CVE to vulnerability scanning policies