# MA-716.032019: MyCERT Alert - Google Chrome Zero-Day RCE Vulnerability (CVE-2019-5786)

**Date:** 12 Mar 2019  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-716.032019  
**Advisory ID:** MA-716.032019

---

**1.0 Introduction**
Recently, Google has disclosed a security update to issue a critical vulnerability [CVE-2019-5786] that was found in its Chrome browser. Vulnerability in FileReader component allows attacker to remotely read arbitrary files stored in computer and also, performs remote code execution attack beneath running operating system. There have been few reported cases regarding this vulnerability.
**2.0 Impact**
An attacker could trick the victim by redirecting them to craft webpage and execute malicious codes on unpatched Google Chrome browser which may lead to user`s data that was stored locally on the system to be compromised.
**3.0 Affected Product**
- Google Chrome browser version 72.0.3626.121 in Windows, Apple, macOS and Linux operating systems.
**4.0 Recommendations**
Users are advice to update their Google Chrome browser to the latest version immediately.
**5.0 References**
• <https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5786>
• <https://chromereleases.googleblog.com/2019/03/stable-channel-update-for-desktop.html>
• <https://securityaffairs.co/wordpress/82058/hacking/chrome-zero-day-cve-2019-5786.html>
• <https://www.csa.gov.sg/singcert/news/advisories-alerts/alert-on-critical-vulnerability-cve-2019-5786-in-google-chrome>
• <https://security.googleblog.com/2019/03/disclosing-vulnerabilities-to-protect.html>
• <https://bugs.chromium.org/p/chromium/issues/detail?id=936448>
Generally, MyCERT advises the users of this product to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#74170d1611064d4d4d34170d16110607111701061d000d5a190d) or [[email protected]](/cdn-cgi/l/email-protection#290944504a4c5b5d6944504a4c5b5d07465b4e074450)
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 89453442
Handphone: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 AM - 18:00 PM MYT
Web: <https://www.mycert.org.my>
Twitter: <http://www.twitter.com/mycert>
Facebook: <http://www.facebook.com/mycert.org.my>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)