CVE-2019-13720
Google Chrome WebAudio Use-After-Free Vulnerability
Description
CVE-2019-13720 is a use-after-free vulnerability in the WebAudio component of Google Chrome that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability enables an attacker to execute arbitrary code within the Chrome browser process when a user visits a malicious website. CISA has confirmed active exploitation and added CVE-2019-13720 to the Known Exploited Vulnerabilities (KEV) catalog. With an EPSS percentile of 99.5%, this is among the most actively exploited Chrome vulnerabilities, having been used as a zero-day in targeted watering hole attacks.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 78.0.3904.87 | |
| opensuse | leap | 15.1 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
References
- http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00022.html(Mailing List, Third Party Advisory)
- http://packetstormsecurity.com/files/167066/Google-Chrome-78.0.3904.70-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-desktop_31.html(Vendor Advisory)
- https://crbug.com/1019226(Permissions Required)
- https://security.gentoo.org/glsa/202004-04(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-13720(US Government Resource)
Weakness Type
CWE-416: Use After Free
CWE-416 describes a weakness where a program references memory after it has been freed, which can result in data corruption, code execution, or crashes. In CVE-2019-13720, Chrome's WebAudio component continues to access heap memory after it has been deallocated, allowing an attacker to place controlled data in the freed memory region and hijack execution through a specially crafted HTML page.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2019-13720 is a use-after-free vulnerability in Chrome's WebAudio component that enables remote code execution through heap corruption. The attack is network-based and requires only that a victim visits a crafted HTML page — no authentication or special privileges are needed from the attacker's perspective, and user interaction is limited to browsing to the malicious page. Successful exploitation allows an attacker to execute arbitrary code within the Chrome renderer process, and with additional sandbox escape techniques, can achieve full system compromise. The EPSS percentile of 99.5% places this among the most exploited browser vulnerabilities, reflecting its use in real-world zero-day attack campaigns. Google's threat analysis group identified the vulnerability being actively exploited in a watering hole attack campaign, where legitimate websites frequented by specific target groups were compromised to deliver the exploit. This targeted exploitation approach means high-value organizations and individuals were specifically at risk.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2019-13720 in the wild by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of June 13, 2022. The EPSS percentile of 99.5% places this vulnerability among the top 0.5% of all CVEs for exploitation likelihood. Google confirmed that CVE-2019-13720 was exploited as a zero-day prior to the patch release, discovered in a targeted watering hole attack campaign. The exploit was delivered through compromised legitimate websites, targeting specific user groups who frequented those sites. This sophisticated attack vector — combined with the zero-day status — indicates state-level or advanced persistent threat actor involvement. The availability of in-the-wild exploit code significantly lowers the barrier for other threat actors to adopt this vulnerability.
Remediation
- Update Google Chrome to the latest version immediately. CVE-2019-13720 was addressed in a Chrome security update. Chrome's automatic update mechanism should deploy this fix, but administrators should verify the installed version across all endpoints.
- Enable and enforce Chrome automatic updates across the enterprise using Chrome management policies to prevent delayed patching that leaves systems exposed to known zero-day exploits.
- Deploy browser isolation solutions to contain the impact of browser-based code execution exploits, preventing them from affecting the host operating system.
- Implement web content filtering with reputation-based URL blocking to reduce exposure to watering hole attacks, which was the observed delivery method for this exploit.
- Monitor for indicators of compromise associated with the watering hole campaign that delivered this exploit, including connections to known command-and-control infrastructure and unusual WebAudio API usage patterns in browser logs.
Technical Details
CVE-2019-13720 is a use-after-free vulnerability in Chrome's WebAudio component, which provides high-performance audio processing capabilities through the Web Audio API. The flaw occurs when a WebAudio node's underlying memory is freed while active references to it still exist within the audio processing pipeline. An attacker can trigger this condition by creating a specific sequence of WebAudio API operations through JavaScript that cause a node to be deallocated while it is still being referenced by the audio rendering thread. Once the memory is freed, the attacker uses heap manipulation techniques to allocate controlled data in the same memory region, so that when the dangling pointer is subsequently dereferenced, it reads attacker-controlled values. This allows the attacker to corrupt function pointers or virtual table entries, redirecting execution to shellcode or ROP chains that achieve arbitrary code execution within the Chrome renderer process. The exploit was discovered in a watering hole attack where compromised websites served the malicious HTML/JavaScript payload to targeted visitors.
Frequently Asked Questions
Is CVE-2019-13720 being actively exploited?
Yes, CVE-2019-13720 was exploited as a zero-day vulnerability in targeted watering hole attacks before a patch was available. CISA has included it in the KEV catalog, and its EPSS percentile of 99.5% confirms it is among the most exploited browser vulnerabilities.
What products are affected by CVE-2019-13720?
CVE-2019-13720 affects Google Chrome's WebAudio component. All Chrome versions prior to the security update that addressed this vulnerability are affected across Windows, macOS, and Linux platforms. Other Chromium-based browsers may also be impacted.
How do I fix CVE-2019-13720?
Update Google Chrome to the latest available version. Ensure automatic updates are enabled and functioning. In enterprise environments, use Chrome management policies to enforce update compliance and consider deploying browser isolation solutions.
How severe is CVE-2019-13720?
CVE-2019-13720 is a critical use-after-free vulnerability with an EPSS percentile of 99.5%. It was exploited as a zero-day in sophisticated watering hole attacks, indicating advanced threat actor involvement. The vulnerability enables remote code execution through simply visiting a malicious web page.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.