CVE-2019-13720

What is Chrome's WebAudio API?

The Web Audio API lets web pages generate, process, and analyze audio directly in the browser without plugins, used by everything from streaming media sites to online games. As with any complex, C++-implemented browser subsystem exposed to untrusted web content, its object lifecycle management is a prime target for memory-corruption bugs that a malicious web page can trigger just by being visited.

Overview

CVE-2019-13720 is a use-after-free vulnerability in Chrome's WebAudio implementation that was discovered being actively exploited in the wild as a zero-day in a campaign researchers dubbed "Operation WizardOpium." A specially crafted HTML page could trigger the flaw to corrupt the browser's heap and, chained with a sandbox-escape/renderer-exploitation technique, achieve remote code execution against visitors who simply loaded the malicious page — no other user interaction was required.

Technical Details

The vulnerability (CWE-416, use-after-free) occurs when an object related to WebAudio's audio-processing pipeline is freed while a reference to it is retained and later dereferenced by other code in the rendering engine. By manipulating the timing and state of audio nodes/objects — for instance, through a sequence of API calls that free and then trigger a callback referencing the freed object — an attacker-controlled web page can gain control over freed memory, and with careful heap grooming, convert that into an arbitrary read/write primitive usable for further exploitation inside the renderer process. Delivery required only that the victim visit a malicious page in Chrome, with no further clicks or downloads needed.

Discovery

The zero-day was discovered by Anton Ivanov and Alexey Kulaev of Kaspersky's Global Research and Analysis Team (GReAT), who identified it being used in a watering-hole attack compromising a South Korean news portal to serve the exploit selectively to visitors, in the campaign Kaspersky named Operation WizardOpium. Google shipped an emergency Chrome update within days of the report.

Exploitation Context

This was a confirmed in-the-wild zero-day used in a targeted watering-hole campaign rather than broad opportunistic exploitation, with Kaspersky noting some technical overlap in exploitation patterns with previously observed North Korea-linked activity, though attribution for Operation WizardOpium itself was not definitively established at the time. CISA's KEV catalog listing confirms continued confirmed exploitation against unpatched Chrome installations.

Remediation

1. Update Chrome to 78.0.3904.87 or later, which contains Google's emergency fix — Chrome's auto-update mechanism generally applies this automatically, but verify manually on managed/enterprise fleets.
2. Ensure Chromium-based browsers beyond Google Chrome itself (which shared the same underlying rendering engine) received equivalent updates.
3. Keep browser auto-update enabled organization-wide so future zero-day fixes reach endpoints within hours rather than through a delayed patch cycle.
4. For organizations in sectors previously targeted by watering-hole campaigns, apply web-filtering/threat-intelligence feeds capable of flagging compromised or malicious sites that could serve browser exploits.
5. Deploy endpoint detection capable of identifying anomalous renderer-process behavior consistent with browser exploitation attempts.