CVE-2019-5826: Use After Free

Q: What is the severity of CVE-2019-5826?

CVE-2019-5826 has a high severity rating due to the potential for heap corruption via a crafted HTML page.

Q: How do I fix CVE-2019-5826?

To fix CVE-2019-5826, update Google Chrome to version 73.0.3683.86 or later.

Q: Which versions of Chrome are affected by CVE-2019-5826?

CVE-2019-5826 affects Google Chrome versions prior to 73.0.3683.86.

Q: Can CVE-2019-5826 be exploited remotely?

Yes, CVE-2019-5826 can be exploited remotely by an attacker who has compromised the renderer process.

Q: What does CVE-2019-5826 involve?

CVE-2019-5826 involves a use after free vulnerability in IndexedDB in Google Chrome.

Published Nov 25, 2019

Updated

Use after free in IndexedDB in Google Chrome prior to 73.0.3683.86 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.

Affected Software

2 affected componentsFixes available

Google Chrome<73.0.3683.86

debian/chromium

150.0.7871.100-1~deb12u1156.0.8078.79-1~deb12u1150.0.7871.181-1~deb13u1156.0.8078.79-1~deb13u1156.0.8078.79-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1

Event History

Nov 25, 2019

CVE Published

via MITRE·07:41 PM

Data Sourced

via MITRE·07:41 PM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

DSA-4500

Frequently Asked Questions

What is the severity of CVE-2019-5826?

CVE-2019-5826 has a high severity rating due to the potential for heap corruption via a crafted HTML page.

How do I fix CVE-2019-5826?