# CVE-2019-13720: Chrome use-after-free in webaudio

Use-after-free in Chrome Blink webaudio ConvolverNode: main thread frees reverb_ while audio thread uses it, enabling renderer RCE.

- Payout: Real-world hack
- Severity: high
- Program: Google Chrome
- Credited: Sergei Glazunov & Maddie Stone, Project Zero (Originally posted on [Project Zero blog](https://googleprojectzero.blogspot.com/p/rca.html) 2020-07-27)
- Disclosed: 2019-10-31
- CVE: CVE-2019-13720
- Write-up quality: 8/10
- Original: https://github.com/googleprojectzero/0days-in-the-wild/blob/main/0day-RCAs/2019/CVE-2019-13720.md
- Library page: https://bugbountylibrary.com/r/p0%3ACVE-2019-13720
- Tags: domain:browser impact:rce kind:incident platform:project-zero sev:high tech:chromium technique:chained technique:source-review vuln:memory-corruption vuln:race-condition

**Target:** Blink renderer webaudio ConvolverNode (convolver_node.cc)
**Root cause:** ConvolverHandler::SetBuffer frees reverb_/shared_buffer_ without holding process_lock_, while the audio rendering thread's Process() reads reverb_ under a try-lock, causing a use-after-free.
**Steps:**
1. Create an AudioContext and a ConvolverNode with a valid buffer.
2. Call startRendering so the audio rendering thread enters ConvolverHandler::Process and reads reverb_.
3. From the main thread, loop setting `convolver.buffer = null` (SetBuffer with null buffer) to free reverb_ via reverb_.reset().
4. Race the free against Process()'s use of reverb_ to trigger UAF.
5. Exploit by corrupting PartitionPage metadata for arbitrary read/write, then use WebAssembly to map RWX pages for code execution.
**How found:** Not stated for the original discovery; Project Zero notes the bug is shallow and could be found via fuzzing, manual audit, or static analysis, likely aided by prior webaudio lifetime bugs (CVE-2019-5851).
**Exploitation:** Attacker-controlled page triggers the UAF race; exploit modifies PartitionPage metadata to gain arbitrary read/write, then abuses WebAssembly to map RWX pages and achieve renderer code execution. Paired with Windows EoP CVE-2019-1458 for sandbox escape in Operation WizardOpium.
**Escalation:** Chained renderer RCE with Windows privilege escalation CVE-2019-1458 to escape the sandbox.
**Insight:** In multithreaded audio/graphics modules, look for members freed on the main thread while a try-lock-protected consumer thread reads them; a try-lock that silently skips work does not protect the free path.