CVE-2019-13724
Out of bounds memory access in WebBluetooth in Google Chrome prior to 78.0.3904.108 allowed a...
8.8 HighFix available
Out of bounds memory access in WebBluetooth in Google Chrome prior to 78.0.3904.108 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
1.44%Up 0.5 points since Apr 14, 2021
What each source reports
NVD Score used
Out of bounds memory access in WebBluetooth in Google Chrome prior to 78.0.3904.108 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
- Record
CVE-2019-13724- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-787
- Updated
- 2026-11-02
CVE List No score
Out of bounds memory access in WebBluetooth in Google Chrome prior to 78.0.3904.108 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
- Record
CVE-2019-13724- Updated
- 2026-11-02
EUVDEUVD-2019-5143 No score
Out of bounds memory access in WebBluetooth in Google Chrome prior to 78.0.3904.108 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
- Record
EUVD-2019-5143- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-5qwf-cc5w-wpvx No score
Out of bounds memory access in WebBluetooth in Google Chrome prior to 78.0.3904.108 allowed a...
Out of bounds memory access in WebBluetooth in Google Chrome prior to 78.0.3904.108 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
- Record
GHSA-5qwf-cc5w-wpvx- Updated
- 2026-11-02
OSV
Out of bounds memory access in WebBluetooth in Google Chrome prior to 78.0.3904.108 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
- Record
CVE-2019-13724- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-13724
Out of bounds memory access in WebBluetooth in Google Chrome prior to 78.0.3904.108 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
- Record
DEBIAN-CVE-2019-13724- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 11 moreShow less
OSVRHSA-2019:3955
Red Hat Security Advisory: chromium-browser security update
- Record
RHSA-2019:3955- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-13724
Out of bounds memory access in WebBluetooth in Google Chrome prior to 78.0.3904.108 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
- Record
UBUNTU-CVE-2019-13724- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2019-0347 No score
Updated chromium-browser-stable packages fix security vulnerabilities
Chromium-browser 78.0.3904.108 fixes security issues:
Multiple flaws were found in the way Chromium 78.0.3904.87 processes various types of web content, where loading a web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information. (CVE-2019-13723, CVE-2019-13724)
- Record
MGASA-2019-0347- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2537-1 No score
Security update for chromium
This update for chromium to version 78.0.3904.108 fixes the following issues:
- Chromium was updated to 78.0.3904.108 (boo#1157269)
Security issues fixed:
- CVE-2019-13723: Fixed a use-after-free in Bluetooth
- CVE-2019-13724: Fixed an out of bounds access in Bluetooth
- Record
openSUSE-SU-2019:2537-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2538-1 No score
Security update for chromium
This update for chromium to version 78.0.3904.108 fixes the following issues:
- Chromium was updated to 78.0.3904.108 (boo#1157269)
Security issues fixed:
- CVE-2019-13723: Fixed a use-after-free in Bluetooth
- CVE-2019-13724: Fixed an out of bounds access in Bluetooth
- Record
openSUSE-SU-2019:2538-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2539-1 No score
Security update for chromium
This update for chromium to version 78.0.3904.108 fixes the following issues:
- Chromium was updated to 78.0.3904.108 (boo#1157269)
Security issues fixed:
- CVE-2019-13723: Fixed a use-after-free in Bluetooth
- CVE-2019-13724: Fixed an out of bounds access in Bluetooth
- Record
openSUSE-SU-2019:2539-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2544-1 No score
Security update for chromium
This update for chromium to version 78.0.3904.108 fixes the following issues:
- Chromium was updated to 78.0.3904.108 (boo#1157269)
Security issues fixed:
- CVE-2019-13723: Fixed a use-after-free in Bluetooth
- CVE-2019-13724: Fixed an out of bounds access in Bluetooth
- Record
openSUSE-SU-2019:2544-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2545-1 No score
Security update for chromium
This update for chromium to version 78.0.3904.108 fixes the following issues:
- Chromium was updated to 78.0.3904.108 (boo#1157269)
Security issues fixed:
- CVE-2019-13723: Fixed a use-after-free in Bluetooth
- CVE-2019-13724: Fixed an out of bounds access in Bluetooth
- Record
openSUSE-SU-2019:2545-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2019:2693-1 No score
Security update for chromium
This update for chromium to version 78.0.3904.108 fixes the following issues:
- Chromium was updated to 78.0.3904.108 (boo#1157269)
Security issues fixed:
- CVE-2019-13723: Fixed a use-after-free in Bluetooth
- CVE-2019-13724: Fixed an out of bounds access in Bluetooth
This update was imported from the openSUSE:Leap:15.0:Update update project.
- Record
openSUSE-SU-2019:2693-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10681-1 No score
chromedriver-93.0.4577.82-1.1 on GA media
These are all security issues fixed in the chromedriver-93.0.4577.82-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10681-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12948-1 No score
ungoogled-chromium-113.0.5672.92-1.1 on GA media
These are all security issues fixed in the ungoogled-chromium-113.0.5672.92-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12948-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chromiumDebian:12 |
before 78.0.3904.108-1 | 78.0.3904.108-1 |
chromiumDebian:13 |
before 78.0.3904.108-1 | 78.0.3904.108-1 |
chromiumDebian:14 |
before 78.0.3904.108-1 | 78.0.3904.108-1 |
chromiumDebian:10 From an advisory covering 2 CVEs |
before 78.0.3904.108-1~deb10u1, plus listed versions 73.0.3683.75-174.0.3729.108-175.0.3770.10-175.0.3770.80-175.0.3770.90-1 Show 9 moreShow less76.0.3809.100-176.0.3809.100-1~deb10u176.0.3809.62-176.0.3809.71-176.0.3809.87-176.0.3809.87-278.0.3904.87-178.0.3904.97-178.0.3904.97-1~deb10u1 |
78.0.3904.108-1~deb10u1 |
chromium-browser-stableMageia:7 From an advisory covering 2 CVEs |
before 78.0.3904.108-1.mga7 | 78.0.3904.108-1.mga7 |
chromium-browserRed Hat:rhel_extras:6 From an advisory covering 2 CVEs |
before 0:78.0.3904.108-1.el6_10 | 0:78.0.3904.108-1.el6_10 |
chromium-browser-debuginfoRed Hat:rhel_extras:6 From an advisory covering 2 CVEs |
before 0:78.0.3904.108-1.el6_10 | 0:78.0.3904.108-1.el6_10 |
chromium-browserUbuntu:16.04:LTS |
before 78.0.3904.108-0ubuntu0.16.04.1, plus listed versions 45.0.2454.101-0ubuntu1.120147.0.2526.73-0ubuntu1.121847.0.2526.106-0ubuntu1.122148.0.2564.82-0ubuntu1.122248.0.2564.116-0ubuntu1.1229 Show 45 moreShow less49.0.2623.87-0ubuntu1.123249.0.2623.108-0ubuntu1.123350.0.2661.102-0ubuntu0.16.04.1.123751.0.2704.79-0ubuntu0.16.04.1.124252.0.2743.116-0ubuntu0.16.04.1.125053.0.2785.143-0ubuntu0.16.04.1.125453.0.2785.143-0ubuntu0.16.04.1.125755.0.2883.87-0ubuntu0.16.04.126356.0.2924.76-0ubuntu0.16.04.126857.0.2987.98-0ubuntu0.16.04.127658.0.3029.81-0ubuntu0.16.04.127758.0.3029.96-0ubuntu0.16.04.127958.0.3029.110-0ubuntu0.16.04.128159.0.3071.109-0ubuntu0.16.04.128959.0.3071.109-0ubuntu0.16.04.129160.0.3112.78-0ubuntu0.16.04.129360.0.3112.113-0ubuntu0.16.04.129861.0.3163.79-0ubuntu0.16.04.130061.0.3163.100-0ubuntu0.16.04.130662.0.3202.62-0ubuntu0.16.04.130862.0.3202.75-0ubuntu0.16.04.131362.0.3202.89-0ubuntu0.16.04.131562.0.3202.94-0ubuntu0.16.04.131763.0.3239.84-0ubuntu0.16.04.163.0.3239.132-0ubuntu0.16.04.164.0.3282.119-0ubuntu0.16.04.164.0.3282.140-0ubuntu0.16.04.164.0.3282.167-0ubuntu0.16.04.165.0.3325.181-0ubuntu0.16.04.166.0.3359.139-0ubuntu0.16.04.366.0.3359.181-0ubuntu0.16.04.167.0.3396.99-0ubuntu0.16.04.268.0.3440.75-0ubuntu0.16.04.168.0.3440.106-0ubuntu0.16.04.169.0.3497.81-0ubuntu0.16.04.170.0.3538.67-0ubuntu0.16.04.170.0.3538.77-0ubuntu0.16.04.170.0.3538.110-0ubuntu0.16.04.171.0.3578.80-0ubuntu0.16.04.171.0.3578.98-0ubuntu0.16.04.172.0.3626.119-0ubuntu0.16.04.172.0.3626.121-0ubuntu0.16.04.173.0.3683.75-0ubuntu0.16.04.173.0.3683.86-0ubuntu0.16.04.174.0.3729.169-0ubuntu0.16.04.1 |
78.0.3904.108-0ubuntu0.16.04.1 |
chromium-browserUbuntu:18.04:LTS |
before 78.0.3904.108-0ubuntu0.18.04.1, plus listed versions 61.0.3163.100-0ubuntu1.137862.0.3202.62-0ubuntu0.17.10.138062.0.3202.89-0ubuntu1.138662.0.3202.94-0ubuntu1.138863.0.3239.84-0ubuntu1 Show 29 moreShow less63.0.3239.108-0ubuntu164.0.3282.119-0ubuntu164.0.3282.140-0ubuntu164.0.3282.167-0ubuntu165.0.3325.146-0ubuntu165.0.3325.181-0ubuntu166.0.3359.139-0ubuntu0.18.04.366.0.3359.181-0ubuntu0.18.04.167.0.3396.99-0ubuntu0.18.04.168.0.3440.75-0ubuntu0.18.04.168.0.3440.106-0ubuntu0.18.04.169.0.3497.81-0ubuntu0.18.04.170.0.3538.67-0ubuntu0.18.04.170.0.3538.77-0ubuntu0.18.04.170.0.3538.110-0ubuntu0.18.04.171.0.3578.80-0ubuntu0.18.04.171.0.3578.98-0ubuntu0.18.04.172.0.3626.119-0ubuntu0.18.04.172.0.3626.121-0ubuntu0.18.04.173.0.3683.75-0ubuntu0.18.04.173.0.3683.86-0ubuntu0.18.04.174.0.3729.169-0ubuntu0.18.04.175.0.3770.90-0ubuntu0.18.04.175.0.3770.142-0ubuntu0.18.04.176.0.3809.87-0ubuntu0.18.04.176.0.3809.100-0ubuntu0.18.04.177.0.3865.90-0ubuntu0.18.04.178.0.3904.70-0ubuntu0.18.04.278.0.3904.97-0ubuntu0.18.04.1 |
78.0.3904.108-0ubuntu0.18.04.1 |
chromiumSUSE:Package Hub 15 From an advisory covering 2 CVEs |
before 78.0.3904.108-bp150.249.1 | 78.0.3904.108-bp150.249.1 |
Show 7 moreShow less
| Package | Affected | Fixed |
|---|---|---|
chromiumSUSE:Package Hub 12 SP3 From an advisory covering 2 CVEs |
before 78.0.3904.108-16.1 | 78.0.3904.108-16.1 |
chromiumSUSE:Package Hub 15 SP1 From an advisory covering 2 CVEs |
before 78.0.3904.108-bp151.3.31.1 | 78.0.3904.108-bp151.3.31.1 |
chromiumopenSUSE:Leap 15.1 From an advisory covering 2 CVEs |
before 78.0.3904.108-lp151.2.48.1 | 78.0.3904.108-lp151.2.48.1 |
chromiumopenSUSE:Leap 15.0 From an advisory covering 2 CVEs |
before 78.0.3904.108-lp150.257.1 | 78.0.3904.108-lp150.257.1 |
chromiumSUSE:Package Hub 15 From an advisory covering 2 CVEs |
before 78.0.3904.108-bp150.255.1 | 78.0.3904.108-bp150.255.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 1081 CVEs |
before 93.0.4577.82-1.1 | 93.0.4577.82-1.1 |
chromiumopenSUSE:Tumbleweed From an advisory covering 2310 CVEs |
before 113.0.5672.92-1.1 | 113.0.5672.92-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-13724 is a high vulnerability (CVSS 8.8) in Google Chrome, published November 21, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.44%, the 73rd percentile. Fixed in chromium 78.0.3904.108-1.
References
chromereleases.googleblog.com/2019/11/stable-channel-update-for-desktop_18.html
crbug.com/1024116
access.redhat.com/errata/RHSA-2019:3955
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/54XWRJ5LDFL27QXBPIBX3EHO4TPMKN4R
lists.opensuse.org/opensuse-security-announce/2019-12/msg00035.html
Show 194 moreShow less
security.gentoo.org/glsa/202003-08
nvd.nist.gov/vuln/detail/CVE-2019-13724
github.com/advisories/GHSA-5qwf-cc5w-wpvx
security-tracker.debian.org/tracker/CVE-2019-13724
advisories.mageia.org/MGASA-2019-0347.html
bugs.mageia.org/show_bug.cgi?id=25733
bugzilla.redhat.com/show_bug.cgi?id=1775340
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3955.json
cve.org/CVERecord?id=CVE-2019-13723
ubuntu.com/security/CVE-2019-13724
bugzilla.suse.com/1157269
suse.com/security/cve/CVE-2019-13723
This page doesn't list everything
Left out here: 5 versions and 2,142 references. The JSON record has them.