# CVE-2019-5786

Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page.

- Page: https://www.vulneraibility.com/cve/CVE-2019-5786
- CVSS: 6.5
- Known exploited: yes, in CISA KEV since 2022-05-23; CISA due date 2022-06-13
- EPSS: 61.09% (percentile 99.2)
- Public exploit code: 2 on Exploit-DB · 1 Metasploit module · 1 GitHub proof of concept (first 2019-03-20)
- CISA SSVC: exploitation active, automatable no, technical impact partial (assessed 2025-02-11)
- Weakness: CWE-416
- Published: 2019-06-27

## Affected versions

- Google Chrome: affected < 72.0.3626.121

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://crbug.com/936448
- [other] https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop.html
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-5786

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.