CVE-2019-5852: Input Validation
Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 76.0.3809.87 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to persuade a user to load a crafted HTML page. No attacker privileges are required, and the attack can be delivered remotely over the network.
What information could be exposed if exploitation succeeds?
A successful attack could allow the attacker to obtain potentially sensitive information from process memory. The available data does not indicate integrity or availability impact.
Which installations should be prioritized for remediation?
Google Chrome versions before 76.0.3809.87 are affected. Debian Chromium is also listed as affected software, but the provided data does not specify the fixed Debian package version.