CVE-2019-5850: free in offline page fetcher
Use after free in offline mode in Google Chrome prior to 76.0.3809.87 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 76.0.3809.87 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What must an attacker achieve before this issue can be exploited?
The attacker must first compromise the Chrome renderer process. The vulnerability can then be triggered with a crafted HTML page to potentially escape the sandbox.
Which versions are affected?
Google Chrome versions prior to 76.0.3809.87 are affected. The listed software also includes Debian Chromium, but no specific affected Debian package versions are provided.
Does exploitation require user interaction?
Yes. The CVSS vector indicates user interaction is required. The provided information does not specify what action the user must take.