CVE-2019-13698: OOB access in V8
Out of bounds memory access in JavaScript in Google Chrome prior to 73.0.3683.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 73.0.3683.103 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users running Google Chrome versions earlier than 73.0.3683.103 are affected. The listed software also includes Debian chromium.
What does an attacker need to exploit it?
An attacker can attempt exploitation remotely by getting a user to load a crafted HTML page. The CVSS vector indicates no prior privileges are required, but user interaction is required.
What is the potential impact of successful exploitation?
The flaw can lead to heap corruption through an out-of-bounds JavaScript memory access. The CVSS rating indicates potential high impact to confidentiality, integrity, and availability.