Use-after-free in Google Chrome - CVE-2019-5786

Vulnerability details

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error in FileReader. A remote attacker can trick the victim into opening a specially crafted file with Google Chrome, trigger use-after-free error and execute arbitrary code on the target system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Note: the vulnerability is being exploited in the wild.

Affected software

How to mitigate CVE-2019-5786

Links to Public Exploits and PoC-codes

• Exploit #6021 - Google Chrome 72.0.3626.119 - 'FileReader' Use-After-Free (Metasploit) (June 17, 2021)
• Exploit #1987 - CVE-2019-5786 (FileReader Exploit) (March 18, 2020)
• Exploit #232 - CVE-2019-0808 (Win32k Exploit by Grant Willcox) (March 18, 2020)
• Exploit #1530 - Chrome 72.0.3626.119 FileReader UaF exploit for Windows 7 x86 (March 18, 2020)

External References

• https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop.html
• https://github.com/AOSC-Dev/aosc-os-abbs/issues/1699

Related Security Bulletins

• Remote code execution in Google Chrome
• OpenSUSE Linux update for chromium
• OpenSUSE Linux update for chromium
• Arch Linux update for chromium
• Red Hat update for chromium-browser
• Use-after-free in chromium (Alpine package)