CVE-2019-5825
MEDIUM KEVGoogle Chrome < 73.0.3683.86 - Out-of-bounds Write via JavaScript Array.map
Title source: llmExploitation Summary
CVE-2019-5825 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added June 8, 2022.
EIP tracks 3 public exploits from researchers including Metasploit, timwr, dmxcsnsbh, István Kurucsai, timwr, including a Metasploit module exploits/multi/browser/chrome_array_map.
AI-analyzed exploit summary This Metasploit module exploits a memory corruption vulnerability in Chrome 72/73 via Array.map to achieve arbitrary read/write, then uses WebAssembly for RWX memory allocation and payload execution. It requires the browser to run with --no-sandbox for full impact.
Description
Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Exploits (3)
This Metasploit module exploits a memory corruption vulnerability in Chrome 72/73 via Array.map to achieve arbitrary read/write, then uses WebAssembly for RWX memory allocation and payload execution. It requires the browser to run with --no-sandbox for full impact.
This repository contains a functional exploit for CVE-2019-5825, targeting a vulnerability in Chrome 73.0.3683.86 (V8 6.9.0). The exploit leverages a type confusion bug to achieve arbitrary read/write (AARW) and executes shellcode via WebAssembly for remote code execution (RCE).
This Metasploit module exploits a memory corruption vulnerability in Google Chrome 72/73 (CVE-2019-5825) by corrupting the length of a float array to achieve arbitrary read/write, then uses WebAssembly to execute shellcode in RWX memory. The exploit requires the browser to be run with --no-sandbox for full impact.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H