CVE-2019-5825: medium-severity vulnerability in Google Chrome
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply updates per vendor instructions.
A flaw in Chrome's JavaScript engine allowed attackers to write data outside intended memory boundaries, potentially corrupting the heap through a malicious webpage. This could crash the browser or enable arbitrary code execution.
Out-of-bounds write vulnerability in Chrome's JavaScript engine (CWE-787) exploitable via crafted HTML. Attack vector is network-based, requiring user interaction to visit a malicious page; successful exploitation leads to heap corruption with potential for code execution or denial of service.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.