PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-5786 Google CVE debrief

CVE-2019-5786 is a Google Chrome Blink use-after-free vulnerability that CISA added to its Known Exploited Vulnerabilities catalog on 2022-05-23. Because it is listed as known exploited, the safest response is to prioritize vendor-recommended updates and verify rollout across managed systems.

Vendor
Google
Product
Chrome Blink
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2022-05-23
Original CVE updated
2022-05-23
Advisory published
2022-05-23
Advisory updated
2022-05-23

Who should care

Security teams, endpoint administrators, browser management owners, and users of Google Chrome or managed Chrome deployments should treat this as a high-priority patch item.

Technical summary

The available corpus identifies the issue as a use-after-free in Chrome’s Blink engine. CISA’s KEV entry marks it as known exploited and instructs affected organizations to apply updates per vendor instructions. The provided source set does not include affected versions, attack prerequisites, or a CVSS score, so those details should be confirmed in official vendor and NVD records before making version-specific decisions.

Defensive priority

High urgency. Because CISA lists the vulnerability in KEV, remediation should be expedited using vendor guidance and validated fleet-wide.

Recommended defensive actions

  • Apply the latest Google Chrome updates according to vendor instructions.
  • Confirm browser update status across managed endpoints and remediate any failures.
  • Prioritize systems that are broadly exposed or difficult to monitor, including user workstations and shared endpoints.
  • Verify that Chrome update policies are enforced and that unsupported installations are removed or isolated.
  • Track the official CVE and NVD records for any version-specific impact or follow-up guidance.

Evidence notes

The source corpus names the vulnerability as "Google Chrome Blink Use-After-Free Vulnerability" and marks it as a CISA KEV entry with dateAdded 2022-05-23 and dueDate 2022-06-13. The official resource links provided are the CVE record, NVD detail page, and CISA KEV catalog/source item. No exploit details, affected-version range, or CVSS score were provided in the supplied corpus.

Sources and references

Verified primary and authoritative sources

  • CVE-2019-5786 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2019-5786

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2019-5786 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2019-5786

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

  • CISA Known Exploited Vulnerabilities catalog

    Publisher, destination, and source semantics verified

    URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

    Cybersecurity and Infrastructure Security Agency - Official CISA catalog of vulnerabilities known to be exploited in the wild.

Supplemental references

  • Source item URL

    Unverified legacy reference

    URL: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json

    cisa_kev

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.