CVE-2019-13720

high

Description

Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

From the Tenable Blog

CVE-2019-13720: Use-After-Free Zero Day in Google Chrome Exploited in the Wild

CVE-2019-13720: Use-After-Free Zero Day in Google Chrome Exploited in the Wild

Published: 2019-11-01

Though details are scant, Google released a patch for a Google Chrome vulnerability that has been exploited in the wild as a zero day. Background On October 31, Google published a Stable Channel Update for the desktop version of Google Chrome. This release fixes two vulnerabilities, one of which has been exploited in the wild as a zero day.

References

https://security.gentoo.org/glsa/202004-04

http://lists.opensuse.org/opensuse-security-announce/2019-12/msg00022.html

https://googleprojectzero.github.io/0days-in-the-wild//0day-RCAs/2019/CVE-2019-13720.html

https://www.tenable.com/blog/cve-2020-15999-cve-2020-17087-google-chrome-microsoft-windows-kernel-zero-day-vulnerabilities-exploited-in-wild-along-with-cve-2020-16009

https://www.tenable.com/blog/cve-2019-13720-use-after-free-zero-day-in-google-chrome-exploited-in-the-wild

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-13720

https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-5139

https://crbug.com/1019226

https://chromereleases.googleblog.com/2019/10/stable-channel-update-for-desktop_31.html

http://packetstormsecurity.com/files/167066/Google-Chrome-78.0.3904.70-Remote-Code-Execution.html

Details

Source: Mitre, NVD

Published: 2019-11-25

Updated: 2026-06-17

Known Exploited Vulnerability (KEV)

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

Severity: Medium

CVSS v3

Base Score: 8.8

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Severity: High

EPSS

EPSS: 0.4914