Patchfirst
Patchfirst
CVE-2019-5786 KEVPublic exploit Medium · 6.5 EPSS 61.1%

Google Chrome Blink Use-After-Free Vulnerability

Google · Chrome Blink

Summary

A use-after-free (object lifetime) flaw in the Blink rendering component of Google Chrome allows a remote attacker to potentially perform out-of-bounds memory access by luring a user to a crafted HTML page. The attack requires no authentication and no network-level access beyond delivering the page, but it does require user interaction, such as the victim visiting the malicious page.

Official description · NVD

Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

Breakdown
67.4 / 100
Exploited
Yes, in CISA KEV
Reports
0
Tactics
2/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

First seen exploited 4 months before it was disclosed. Public exploit code (PoC-in-GitHub) was available 3 months before disclosure.

  1. First seen exploitedVulnCheck KEV evidence4 mo before
  2. Public exploit codePoC-in-GitHub3 mo before
  3. Disclosedday 0
  4. Added to CISA KEVEU database agrees+3 yrs

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

techniques

2 , grouped by in kill-chain order, 2 cited passages 2

Initial AccessTA0001

Drive-by Compromise T1189 Medium
AI mapping from the description · how it is exploited

Malicious webpage delivered to victim's browser

via a crafted HTML page
From the official description (NVD) Original (opens in a new tab) ↗

ImpactTA0040

Application or System Exploitation T1499.004 Medium
AI mapping from the description · primary impact

Memory corruption causing browser crash

potentially perform out of bounds memory access
From the official description (NVD) Original (opens in a new tab) ↗
Lower-confidence links (2)

These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.

  • Exploitation for Privilege EscalationT1068 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)
  • Exploitation for StealthT1211 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)

Detection

0 rules for this CVE · 6 general rules for its techniques

Rules for this CVE

0 that reference CVE-2019-5786 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Drive-by CompromiseT11893 general rules
Application or System ExploitationT1499.0043 general rules

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: puppeteer.

npmpuppeteerGHSA-c2gp-86p4-5935

Upgrade to 1.13.0 or later

npmnpm install puppeteer@1.13.0

The first fix for CVE-2019-5786. No other CVE tracked by Patchfirst affects this package.

Affected versions

If you runUpgrade to
All versions before 1.13.01.13.0

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

3 links, grouped by NVD tag (2 duplicates merged)

Vendor Advisory 1

chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop.html

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-5786

Exploit 1

crbug.com/936448
↑ ↓ chooseEnter openEsc close