CVE-2019-5784: Medium severity Google Chrome vulnerability
Incorrect handling of deferred code in V8 in Google Chrome prior to 72.0.3626.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 72.0.3626.96 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1
Event History
Frequently Asked Questions
Which systems are exposed?
Google Chrome versions before 72.0.3626.96 are affected. Debian Chromium is also listed as affected software, but no Debian package-version range is provided.
What does an attacker need to exploit this issue?
An attacker can deliver a crafted HTML page remotely without privileges. The CVSS vector indicates user interaction is required, so a user would need to interact with attacker-controlled web content.
What is the likely security impact?
The issue is rated medium severity with a 6.5 CVSS score. The supplied vector indicates high availability impact, with no confidentiality or integrity impact indicated.