CVE-2019-5857: Medium severity Google Chrome vulnerability
Inappropriate implementation in JavaScript in Google Chrome prior to 76.0.3809.87 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page.
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Google Chrome (Trace Event)to a version that resolves this vulnerability.Fixed in 76.0.3809.87 - Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.79-1
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
Who can be exposed to this issue?
Users of Google Chrome versions prior to 76.0.3809.87 are affected. The listed software also includes Debian Chromium.
What must an attacker do to exploit the vulnerability?
An attacker can attempt exploitation remotely by getting a user to interact with a crafted HTML page. No attacker privileges are required, but user interaction is required.
What is the expected impact of successful exploitation?
The CVSS vector indicates no confidentiality or integrity impact, but a high availability impact. The issue involves potential object corruption in JavaScript.
How can I remediate it?
Update Google Chrome to version 76.0.3809.87 or later. For Debian Chromium, consult the referenced Debian security advisory for the applicable package update.