Google Chrome 72.0.3626.121 released to address in-the-wild exploitation of CVE-2019-5786.
Background
On March 1, Google announced the availability of Google Chrome version 72.0.3626.121 for Windows, Mac and Linux. On March 5, Google provided additional context about this release.
Analysis
Google Chrome 72.0.3626.121 addresses CVE-2019-5786, a Use-After-Free (UAF) vulnerability in FileReader, an application programming interface (API) included in browsers to allow web applications to read the contents of files stored on a user’s computer. According to Google, this vulnerability has been exploited in the wild and was discovered and reported by Clement Lecigne, a security engineer from Google's Threat Analysis Group, at the end of February.
Solution
Tenable strongly advises users to upgrade to Google Chrome 72.0.3626.121 as soon as possible. Justin Schuh, leader of Google Chrome’s Security and Desktop team, has issued a public service announcement about this particular release.
Also, seriously, update your Chrome installs... like right this minute. #PSA
— Justin Schuh (@justinschuh) March 6, 2019
Identifying affected systems
A list of Nessus plugins to identify this vulnerability will appear here as they’re released.
Get more information
Join Tenable's Security Response Team on the Tenable Community.
Learn more about Tenable, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a free 60-day trial of Tenable.io Vulnerability Management.