CVE-2019-5825: Google Chrome JavaScript out-of-bounds write enables heap corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityThe flaw is remotely reachable, has public exploit references, and is in CISA KEV with high EPSS, though it requires user interaction and only availability impact is scored.

What it is

Google Chrome before 73.0.3683.86 contains an out-of-bounds write in its JavaScript engine. A crafted HTML page can trigger the write and corrupt heap memory. The flaw is remotely reachable and has been exploited in the wild, so unpatched browsers are a real risk.

Impact

An attacker can corrupt heap memory through a malicious page, which can lead to code execution or a browser crash. The CVSS vector rates only availability impact, but the out-of-bounds write class and public exploit references indicate memory corruption that can be chained further.

Attack surface

Reached over the network by loading a crafted HTML page in Chrome; no authentication is required, but the victim must open or be directed to the page (UI:R). The attack is client-side and depends on the browser rendering the malicious content.

Exploitation

CVE-2019-5825 is listed in CISA KEV with a 2022-06-08 addition date, and public exploit references exist (Packet Storm, crbug). EPSS is 0.55925 (99th percentile), indicating high predicted exploitation activity.

What to do

• Update Google Chrome to 73.0.3683.86 or later, and apply the vendor's stable channel update.
• Enforce automatic browser updates and verify version compliance across endpoints.
• Restrict or block untrusted web content and use network controls where feasible.
• Monitor CISA KEV guidance and apply required actions by the stated due date.

Detection

• Hunt for Chrome versions below 73.0.3683.86 in asset inventories and endpoint telemetry.
• Monitor for browser crashes or renderer process terminations that may indicate heap corruption attempts.
• Review proxy and DNS logs for access to known exploit-hosting or malformed-page delivery domains.
• Correlate endpoint process creation of chrome.exe with suspicious child processes or memory anomalies.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.