CVE-2019-5786: Google Chrome Blink use-after-free via crafted HTML page

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

high priorityIt is a remotely reachable use-after-free in a widely deployed browser that CISA lists as known exploited, though the CVSS score is only medium and the record does not confirm code execution impact.

What it is

Chrome's Blink rendering engine has an object lifetime (use-after-free) flaw that allows out-of-bounds memory access when a crafted HTML page is rendered. It affects Chrome versions prior to 72.0.3626.121 and is listed in CISA's Known Exploited Vulnerabilities catalog, so it has been used in real attacks.

Impact

An attacker can trigger out-of-bounds memory access in the browser process, which can lead to memory corruption and potentially code execution in the context of the browser. The CVSS vector rates only availability impact as high, so the record does not confirm confidentiality or integrity impact.

Attack surface

Reached remotely over the network by getting a victim to load a crafted HTML page; no authentication is required, but user interaction (opening the page) is needed per the CVSS vector.

Exploitation

CISA added it to the KEV catalog on 2022-05-23 with a 2022-06-13 remediation due date, and the EPSS 30-day probability is about 0.62 (99th percentile), indicating observed exploitation. Reference tags include an exploit-tagged Chromium issue, though no public exploit code details are given in this record.

What to do

• Update Google Chrome to version 72.0.3626.121 or later, or to the current supported release.
• Verify browser version compliance across managed endpoints and enforce auto-update where possible.
• If immediate patching is not possible, restrict browsing to trusted sites and consider isolating high-risk web use.
• Track remediation against the CISA KEV due date for any remaining unpatched systems.

Detection

• Monitor for Chrome processes spawning unexpected child processes or making anomalous network connections after visiting untrusted pages.
• Hunt for crashes or abnormal terminations of chrome.exe/renderer processes that could indicate memory corruption attempts.
• Check endpoint inventories for Chrome versions below 72.0.3626.121 and alert on any that remain.
• Review proxy or DNS logs for access to known exploit-hosting or malvertising domains in conjunction with browser crash events.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.