CVE-2019-5786: Google Chrome Blink Use-After-Free Vulnerability
Vulnerability summary
CVE-2019-5786 is a medium (CVSS 6.5) Use After Free vulnerability in Google Chrome Blink. It is known to be exploited: CISA lists it, first on 23-05-2022. EPSS estimates a 61.09% chance of exploitation in the next 30 days, higher than 99.1% of scored vulnerabilities. 3 public exploits are recorded.
Listed as exploited by CISA (23-05-2022)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 27-06-2019PublishedVulnerability first disclosed.
- 23-05-2022Added to CISA KEVExploitedGoogle Chrome Blink Use-After-Free Vulnerability
- 13-06-2022CISA remediation dueDeadline passedApply updates per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.
CVSS metrics
9 scores · 7 sources · 3 versions- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · AlpineEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HDiffers
- OSV · NpmEcosystem advisory · calculated6.5MediumCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:HDiffers
EPSS trend
Probability
61.09%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
No change 0.00 pp
From 61.09% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 23-05-2022
- Federal due date
- 13-06-2022
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
CISA required action
Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2019-5786
Public exploits
3 foundExploit Reference (crbug.com)
Maturity: unknown
Google Chrome 72.0.3626.119 - 'FileReader' Use-After-Free (Metasploit)
Maturity: weaponized
Chrome 72.0.3626.119 FileReader UaF exploit for Windows 7 x86
exploit/windows/browser/chrome_filereader_uaf
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat2 products
- chromium-browser< 0:72.0.3626.121-1.el6_10
- chromium-browser-debuginfo< 0:72.0.3626.121-1.el6_10
Suse2 products
- chromium&distro=SUSE Package Hub 12 SP2< 72.0.3626.121-bp150.2.37.1
- chromium&distro=SUSE Package Hub 15< 72.0.3626.121-bp150.2.37.1
Alpine1 product
- chromium< 72.0.3626.121-r0
Debian1 product
- chromium< 72.0.3626.121-1 | < 72.0.3626.122-1~deb9u1
Google1 product
- chrome≥ unspecified, < 72.0.3626.121 | < 72.0.3626.121
Npm1 product
- puppeteer< 1.13.0
Opensuse1 product
- chromium&distro=openSUSE Leap 15.0< 72.0.3626.121-bp150.2.37.1
Ubuntu1 product
- chromium-browser< 72.0.3626.121-0ubuntu0.16.04.1 | < 72.0.3626.121-0ubuntu0.18.04.1
8 vendors · 10 products
References
22 links- chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop.htmlX Refsource MISCARTICLEWEBRelease NotesVendor Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-5786Government ResourceUS Government Resource
- lists.opensuse.org/archives/…Advisory
