Vulnerability: New Chrome Zero-Day Actively Exploited in the Wild

Google’s Threat Analysis Group discovered and disclosed a high severity vulnerability last month that allowed remote code execution on Chrome browsers. The Chrome security team did not release much detail about the vulnerability but did disclose it is a Use-After-Free vulnerability in one of the core components of Chrome. This vulnerability affects Chrome browsers across Windows, Mac and Linux environments. The update was released on Friday, 1 March, along with a warning that the team has received reports of the vulnerability being exploited in the wild.

Recommendations

• Update Google Chrome to the latest stable release on all devices
• Monitor CVE-2019-5786 chatter on ZeroFOX for PoC disclosures

Details

The exploit was found by Clement Lecigne of Google’s Threat Analysis group. Google is withholding information about the bug until a majority of its users update to versions of Chrome that resolve this issue. The Use-After-Free was found in the FileReader component, which is present in all major operating system versions of Chrome. The stable channel update page for Chrome Desktop was updated on 5 March 2019 to add the reporter and exploit in the wild information.