PatchSiren

PatchSiren cyber security CVE debrief

CVE-2019-5786 Google CVE debrief

CVE-2019-5786 is a Google Chrome Blink use-after-free vulnerability that CISA added to its Known Exploited Vulnerabilities catalog on 2022-05-23. Because it is listed as known exploited, the safest response is to prioritize vendor-recommended updates and verify rollout across managed systems.

Vendor
Google
Product
Chrome Blink
CVSS
Unknown
CISA KEV
Listed
Original CVE published
2022-05-23
Original CVE updated
2022-05-23
Advisory published
2022-05-23
Advisory updated
2022-05-23

Who should care

Security teams, endpoint administrators, browser management owners, and users of Google Chrome or managed Chrome deployments should treat this as a high-priority patch item.

Technical summary

The available corpus identifies the issue as a use-after-free in Chrome’s Blink engine. CISA’s KEV entry marks it as known exploited and instructs affected organizations to apply updates per vendor instructions. The provided source set does not include affected versions, attack prerequisites, or a CVSS score, so those details should be confirmed in official vendor and NVD records before making version-specific decisions.

Defensive priority

High urgency. Because CISA lists the vulnerability in KEV, remediation should be expedited using vendor guidance and validated fleet-wide.

Recommended defensive actions

  • Apply the latest Google Chrome updates according to vendor instructions.
  • Confirm browser update status across managed endpoints and remediate any failures.
  • Prioritize systems that are broadly exposed or difficult to monitor, including user workstations and shared endpoints.
  • Verify that Chrome update policies are enforced and that unsupported installations are removed or isolated.
  • Track the official CVE and NVD records for any version-specific impact or follow-up guidance.

Evidence notes

The source corpus names the vulnerability as "Google Chrome Blink Use-After-Free Vulnerability" and marks it as a CISA KEV entry with dateAdded 2022-05-23 and dueDate 2022-06-13. The official resource links provided are the CVE record, NVD detail page, and CISA KEV catalog/source item. No exploit details, affected-version range, or CVSS score were provided in the supplied corpus.

Official resources

CISA KEV listing date provided in the corpus: 2022-05-23. Due date provided in the corpus: 2022-06-13. The CVE published/modified dates supplied for this record are 2022-05-23.