Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2019-13768: Google Chrome: Unprivileged code execution via crafted HTML page

CVE-2019-13768 · published 3 years ago

Summary

A security issue in older versions of Google Chrome could allow an attacker to run unauthorized code on a user's computer if they visit a specially crafted webpage. This could potentially allow the attacker to access sensitive information or take control of the user's system. Update to the latest version of Google Chrome to fix this issue.

What to do

Update google chrome to version 72.0.3626.81 or later.

Affected software

Vendor	Product	Affected versions
google	chrome	< 72.0.3626.81 `cpe:2.3:a:google:chrome::::::::`

Original advisory text

Use after free in FileAPI in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chrome security severity: High)

References

https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.... Release Notes Vendor Advisory
https://crbug.com/922677 Exploit Issue Tracking Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

7.4 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-416Use After Free

Timeline

Published2 Jan 2023

Updated4 Nov 2026

First seen14 Mar 2026

Sources

CVE-2019-13768 · OSV

CVE-2019-13768 · NVD

Track software like this

Free during beta