CVE-2019-13768

HighCVSS 7.4/10Last modified Jun 17, 2026

Description

Use after free in FileAPI in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chrome security severity: High)

Metrics

CVSS 3.1 7.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Google	Chrome	>= unspecified, < 72.0.3626.81

References

https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.htmlRelease Notes, Vendor Advisory
https://crbug.com/922677Exploit, Issue Tracking, Vendor Advisory
https://chromereleases.googleblog.com/2019/01/stable-channel-update-for-desktop.htmlRelease Notes, Vendor Advisory
https://crbug.com/922677Exploit, Issue Tracking, Vendor Advisory

Timeline

Published: Jan 2, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-13787.8An elevation of privilege vulnerability exists in Windows 10 Update Assistant in the way it handles permissions.A locally authenticated atta CVE-2019-13797.8An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka 'Windows Data S CVE-2019-13807.8A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privileg CVE-2019-13815.5An information disclosure vulnerability exists when the Windows Servicing Stack allows access to unprivileged file locations, aka 'Microsoft CVE-2019-13825.5An elevation of privilege vulnerability exists when ActiveX Installer service may allow access to files without proper authentication, aka 'CVE-2019-13837.8An elevation of privilege vulnerability exists when the Windows Data Sharing Service improperly handles file operations, aka 'Windows Data S CVE-2019-13849.9A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages.To exploit this CVE-2019-13857.8An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulti CVE-2019-13878.8An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. Recu CVE-2019-13887.8An elevation of privilege vulnerability exists in the Windows Certificate Dialog when it does not properly enforce user privileges, aka 'Win CVE-2019-13898.4A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated us CVE-2019-13907.5A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka 'VBScript Remote Code Execut