CVE Intelligence
Analysis AI-assisted

CVE-2019-5786: Google Chrome Blink Use-After-Free Vulnerability

CVE-2019-5786 is a use-after-free flaw (CWE-416) in the Blink rendering engine of Google Chrome before 72.0.3626.121, which a remote attacker could potentially trigger with a crafted HTML page. CISA lists it in the Known Exploited Vulnerabilities catalog, and the record also lists npm Puppeteer below 1.13.0 as affected. Updating Chrome and Puppeteer is the main defensive step.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2019-5786 affects the Blink rendering engine in Google Chrome. The record describes it as an object lifetime issue and maps it to CWE-416 (Use After Free). According to the description, a remote attacker could potentially cause out-of-bounds memory access by getting a user to load a crafted HTML page.

Impact

  • NVD scores the issue 6.5 (medium) under CVSS 3.1 with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H, which in the record reflects a high availability impact and no confidentiality or integrity impact.
  • The record's vector requires user interaction (UI:R), which is consistent with the crafted-page scenario described (inference).
  • The record's SSVC data rates technical impact as partial and automatable as no.

Affected products and versions

  • Google Chrome: versions before 72.0.3626.121.
  • npm Puppeteer: versions before 1.13.0. The record lists 1.13.0 as the fixed version, referenced from GitHub advisory GHSA-c2gp-86p4-5935.
  • The record does not list a separate fixed version for Google Chrome. The boundary in the description is 72.0.3626.121, so builds at or after that version are presumed not affected (inference).

Exploitation status

The CISA Known Exploited Vulnerabilities catalog lists CVE-2019-5786, with a date added of 2022-05-23 and a due date of 2022-06-13. This means the vulnerability is recorded as exploited in the wild. The record's ransomware use field is listed as Unknown.

Remediation and mitigation

  • Update Google Chrome to version 72.0.3626.121 or later, or to a current supported stable release.
  • Update npm Puppeteer to 1.13.0 or later in every project that depends on it, and regenerate lockfiles.
  • Follow the KEV required action, which is to apply updates per vendor instructions.
  • Until patching is complete, limit browsing of untrusted content on unpatched systems and prioritize internet-facing or high-value endpoints.

Detection guidance

  • Inventory browser versions across endpoints and flag installations below 72.0.3626.121.
  • Inventory Node.js projects and review package manifests and lockfiles for puppeteer versions below 1.13.0.
  • Review endpoint telemetry for unexpected renderer crashes as a general indicator of memory-corruption problems. This is a general heuristic, not a signature published by the sources.

Limitations of the available information

  • The record does not describe the exact trigger conditions, the platforms affected, or the Chrome release channels involved beyond the version boundary.
  • The description refers to out-of-bounds memory access, while the CWE is Use After Free. The record does not reconcile these two characterizations.
  • The Exodus Intelligence analysis is referenced, but this portal does not reproduce exploitation details and provides no technical attack steps.

Frequently asked questions

Is CVE-2019-5786 known to be exploited?

Yes. The CISA Known Exploited Vulnerabilities catalog lists it, with a date added of 2022-05-23 and a due date of 2022-06-13.

Which versions are affected?

Google Chrome before 72.0.3626.121 and npm Puppeteer before 1.13.0, according to the record.

What should I do first?

Update Chrome to 72.0.3626.121 or later, update Puppeteer to 1.13.0 or later in dependent projects, and inventory systems to find versions still below those thresholds.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.