CVE-2019-5851: poison in offline audio context
Use after free in WebAudio in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 76.0.3809.87 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to get a user to load a crafted HTML page in an affected Chrome or Chromium browser. No authentication or special privileges are required.
Is user interaction required?
Yes. The user must interact with attacker-controlled web content, such as by visiting a crafted page.
What versions are affected?
Google Chrome versions prior to 76.0.3809.87 are affected. The provided data also identifies Debian Chromium, but does not specify its fixed package version.
What is the potential impact of successful exploitation?
Successful exploitation may corrupt heap memory through a use-after-free condition in WebAudio. The listed impact includes high confidentiality, integrity, and availability consequences.