CVE-2019-5786: Google Chrome Blink Use-After-Free Vulnerability
Google Chrome Blink contains a heap use-after-free vulnerability that allows an attacker to potentially perform out of bounds memory access via a crafted HTML page.
Other sources
Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
Versions of puppeteer prior to 1.13.0 are vulnerable to the Use-After-Free vulnerability in Chromium (CVE-2019-5786). The Chromium FileReader API is vulnerable to Use-After-Free which may lead to Remote Code Execution.
Recommendation
Upgrade to version 1.13.0 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/puppeteerto a version that resolves this vulnerability.Fixed in 1.13.0 - Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 72.0.3626.121 - Upgrade
Upgrade
Google Chrometo a version that resolves this vulnerability.Fixed in 72.0.3626.121
Event History
Frequently Asked Questions
What is the severity of CVE-2019-5786?
CVE-2019-5786 has a high severity rating due to its potential to allow attackers to perform out-of-bounds memory access.
How do I fix CVE-2019-5786?
To mitigate CVE-2019-5786, update Google Chrome to version 72.0.3626.121 or later.
Who is affected by CVE-2019-5786?
CVE-2019-5786 affects Google Chrome versions prior to 72.0.3626.121 and the Puppeteer library versions before 1.13.0.
What type of vulnerability is CVE-2019-5786?
CVE-2019-5786 is classified as a heap use-after-free vulnerability affecting the Blink component of Google Chrome.
Can CVE-2019-5786 be exploited remotely?
Yes, CVE-2019-5786 can be exploited remotely via a crafted HTML page.