CVE-2019-5786
Google Chrome Blink Use-After-Free Vulnerability
Description
CVE-2019-5786 is a use-after-free vulnerability in the Blink rendering engine of Google Chrome that allows an attacker to potentially perform out-of-bounds memory access via a crafted HTML page. This heap-based use-after-free flaw can be exploited to achieve remote code execution when a user visits a malicious website. CISA has confirmed active exploitation of CVE-2019-5786 and included it in the Known Exploited Vulnerabilities (KEV) catalog. With an EPSS percentile of 99.5%, this is among the most exploited browser vulnerabilities, representing a critical threat to Chrome users worldwide.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 72.0.3626.121 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
References
- https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop.html(Release Notes, Vendor Advisory)
- https://crbug.com/936448(Exploit, Issue Tracking)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-5786(US Government Resource)
Weakness Type
CWE-416: Use After Free
CWE-416 describes a weakness where a program references memory after it has been freed, which can lead to corruption of valid data, execution of arbitrary code, or program crashes. In CVE-2019-5786, the Chrome Blink rendering engine continues to reference a heap memory allocation after it has been freed, allowing an attacker to control the contents of the freed memory region and hijack program execution through a crafted HTML page.
Learn more: CWE-416 — Use After Free
Impact Analysis
CVE-2019-5786 is a heap use-after-free vulnerability in the Blink rendering engine of Google Chrome that allows an attacker to potentially achieve out-of-bounds memory access and remote code execution. The attack is network-based and requires only that a victim navigates to a crafted HTML page, making it trivially exploitable at scale through phishing emails, malicious advertisements, or compromised websites. No authentication or special privileges are required from the attacker's perspective. Successful exploitation can allow an attacker to execute arbitrary code within the Chrome renderer process, and when chained with a sandbox escape vulnerability, can lead to full system compromise. The EPSS percentile of 99.5% places this vulnerability among the most actively exploited CVEs, reflecting its widespread use in real-world attack campaigns. The massive user base of Google Chrome amplifies the potential impact across consumer and enterprise environments.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2019-5786 in the wild by including it in the Known Exploited Vulnerabilities catalog with a remediation deadline of June 13, 2022. The EPSS percentile of 99.5% places this vulnerability in the top 0.5% of all scored CVEs for exploitation likelihood, reflecting extensive real-world exploitation. Google acknowledged in its advisory that an exploit for CVE-2019-5786 existed in the wild, indicating zero-day exploitation prior to the patch release. This vulnerability was notably used in conjunction with a separate Windows kernel zero-day (CVE-2019-0808) in targeted attacks — the Chrome vulnerability provided initial code execution in the browser, while the Windows kernel bug enabled sandbox escape and full system compromise. This chaining demonstrates the severity of CVE-2019-5786 as a first-stage exploit in sophisticated attack operations.
Remediation
- Update Google Chrome to the latest version immediately. CVE-2019-5786 was patched in Chrome 72.0.3626.121. Chrome's automatic update mechanism should have deployed this fix, but administrators should verify the installed version across all managed systems.
- Enable Chrome's automatic update feature on all endpoints to ensure timely delivery of security patches. In enterprise environments, use Chrome management policies to enforce update compliance.
- Deploy browser isolation or sandboxing solutions that can contain the impact of browser-based exploits, preventing code execution from escaping the browser context to affect the underlying system.
- Implement web content filtering and URL reputation services to block access to known malicious domains hosting exploit kits that target browser vulnerabilities including CVE-2019-5786.
- Ensure the underlying operating system is fully patched, as CVE-2019-5786 was observed being chained with OS-level vulnerabilities such as CVE-2019-0808 in Windows to achieve full system compromise beyond the Chrome sandbox.
Technical Details
CVE-2019-5786 is a heap use-after-free vulnerability in the FileReader API implementation within Chrome's Blink rendering engine. The flaw occurs when a FileReader object's underlying memory is freed while the object still holds a reference to it. When the attacker triggers subsequent operations on the dangling pointer, the program accesses the previously freed heap memory, which the attacker has manipulated to contain controlled data. By carefully shaping the heap layout — a technique known as heap spraying or heap grooming — the attacker can place attacker-controlled data in the freed memory region, allowing them to hijack control flow and achieve arbitrary code execution within the Chrome renderer process. The attack vector is a crafted HTML page that manipulates FileReader objects to trigger the use-after-free condition. Since Chrome employs a multi-process sandboxed architecture, initial code execution occurs within the sandboxed renderer process. However, the vulnerability was observed in the wild being chained with CVE-2019-0808, a Windows Win32k elevation of privilege vulnerability, to escape the sandbox and achieve SYSTEM-level code execution on the host.
Frequently Asked Questions
Is CVE-2019-5786 being actively exploited?
Yes, CVE-2019-5786 has been actively exploited as a zero-day vulnerability. Google confirmed the existence of an in-the-wild exploit, and CISA has included it in the KEV catalog. The EPSS percentile of 99.5% confirms it is among the most exploited browser vulnerabilities.
What products are affected by CVE-2019-5786?
CVE-2019-5786 affects Google Chrome versions prior to 72.0.3626.121 across all platforms where the Blink rendering engine is used. This includes Chrome on Windows, macOS, and Linux. Other Chromium-based browsers may also be affected.
How do I fix CVE-2019-5786?
Update Google Chrome to version 72.0.3626.121 or later. Verify that Chrome's automatic update feature is enabled and functioning. Also ensure the underlying operating system is fully patched, as this vulnerability was chained with OS-level exploits in real-world attacks.
How severe is CVE-2019-5786?
CVE-2019-5786 is a critical use-after-free vulnerability with an EPSS percentile of 99.5%, making it one of the most exploited browser flaws. It was used as a zero-day in targeted attacks chained with a Windows kernel vulnerability for full system compromise. Immediate patching is essential.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.