CVE-2019-5841: High severity Google Chrome vulnerability
Out of bounds memory access in JavaScript in Google Chrome prior to 75.0.3770.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users of Google Chrome versions earlier than 75.0.3770.80 are exposed. The listed affected software also includes Debian's Chromium package.
What does an attacker need to exploit it?
An attacker can attempt exploitation remotely by providing a crafted HTML page. The CVSS vector indicates no prior privileges are required, but user interaction is required, such as visiting or opening the malicious page.
What is the potential impact of successful exploitation?
The out-of-bounds JavaScript memory access can lead to heap corruption. The reported CVSS assessment rates confidentiality, integrity, and availability impact as high.
How can I determine whether a Chrome installation is affected?
Check the installed Chrome version. Versions prior to 75.0.3770.80 are affected; version 75.0.3770.80 or later is not identified as affected by the provided information.