CVE-2019-5825: Google Chromium V8 Out-of-Bounds Write Vulnerability
Vulnerability summary
CVE-2019-5825 is a medium (CVSS 6.5) Out-of-bounds Write vulnerability in Google Chromium V8. It is known to be exploited: CISA lists it, first on 08-06-2022. EPSS estimates a 55.93% chance of exploitation in the next 30 days, higher than 99% of scored vulnerabilities. 4 public exploits are recorded.
Advisory lineage
Upstream 0 · Downstream 3Timeline
- 25-11-2019PublishedVulnerability first disclosed.
- 08-06-2022Added to CISA KEVGoogle Chromium V8 Out-of-Bounds Write Vulnerability
- 22-06-2022CISA remediation dueApply updates per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
55.93%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
0.00 pp
From 55.93% on 19-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 08-06-2022
- Federal due date
- 22-06-2022
CISA required action
Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2019-5825
Public exploits
4 foundExploit Reference (crbug.com)
Maturity: unknown
Exploit Reference (packetstormsecurity.com)
Maturity: unknown
Google Chrome 72 and 73 - Array.map Out-of-Bounds Write (Metasploit)
Maturity: weaponized
Weaknesses
CWE · root causeAffected systems
Debian1 product
- chromium< 75.0.3770.80-1
Google1 product
- chrome≥ unspecified, < 73.0.3683.86 | < 73.0.3683.86
Ubuntu1 product
- chromium-browser< 74.0.3729.169-0ubuntu0.16.04.1 | < 74.0.3729.169-0ubuntu0.18.04.1
3 vendors · 3 products
References
8 links- chromereleases.googleblog.com/2019/04/stable-channel-update-for-desktop_30.htmlX Refsource MISCREPORTRelease NotesVendor Advisory
- packetstormsecurity.com/files/156641/Google-Chrome-72-73-Array.map-Corruption.htmlX Refsource MISCExploitThird Party AdvisoryVDB Entry
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-5825Government ResourceUS Government Resource
