Google plugs Chrome zero-day exploited in the wild

CVE-2019-5786 is a use-after-free (object lifetime) flaw in Blink, the rendering engine of Google Chrome, fixed in Chrome 72.0.3626.121. A remote attacker triggers it by luring a user to a crafted HTML page, where the stale object allows an out-of-bounds memory access within the renderer process. Successful exploitation produces memory corruption in the browser renderer — scored in the CVSS vector primarily as high availability impact — and Google disclosed the flaw being actively exploited in targeted attacks, reportedly chained with a separate Windows zero-day that Microsoft patched out of band in March 2019. Anyone running Chrome older than 72.0.3626.121 was affected, which at disclosure time meant a large share of Chrome's billion-plus desktop user base. Exploitation is confirmed in the wild: the issue was a zero-day before the patch, it was added to CISA's Known Exploited Vulnerabilities catalog on 2022-05-23, and EPSS assigns a ~61.5% probability of exploitation within 30 days (99th percentile).

Do: Update Chrome to 72.0.3626.121 or later — verify via the browser's About/Settings help page and relaunch any pending auto-update, since Chrome self-updates but requires a relaunch. Treat as a KEV priority and patch per vendor instructions, and apply Microsoft's March 2019 updates, including the out-of-band Windows fix, because the Chrome flaw was used in combination with a Windows zero-day in the observed targeted attacks.