Inappropriate implementation in Downloads in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a user to install a malicious extension to bypass file access restrictions via a crafted HTML page. (Chromium security severity: Medium)

The remote host is affected by the vulnerability described in GLSA-202401-34 (Chromium, Google Chrome, Microsoft Edge:
Multiple Vulnerabilities)

    Multiple vulnerabilities have been discovered in Chromium and its derivatives. Please review the CVE     identifiers referenced below for details.

Tenable has extracted the preceding description block directly from the Gentoo Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2023:0124-1 advisory.

  - Out of bounds write in Swiftshader in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-2929)

  - Use after free in Extensions in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a     user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
    (Chromium security severity: High) (CVE-2023-2930)

  - Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially     exploit heap corruption via a crafted PDF file. (Chromium security severity: High) (CVE-2023-2931,     CVE-2023-2932, CVE-2023-2933)

  - Out of bounds memory access in Mojo in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-2934)

  - Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2023-2935,     CVE-2023-2936)

  - Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a     remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar)     via a crafted HTML page. (Chromium security severity: Medium) (CVE-2023-2937, CVE-2023-2938)

  - Insufficient data validation in Installer in Google Chrome on Windows prior to 114.0.5735.90 allowed a     local attacker to perform privilege escalation via crafted symbolic link. (Chromium security severity:
    Medium) (CVE-2023-2939)

  - Inappropriate implementation in Downloads in Google Chrome prior to 114.0.5735.90 allowed an attacker who     convinced a user to install a malicious extension to bypass file access restrictions via a crafted HTML     page. (Chromium security severity: Medium) (CVE-2023-2940)

  - Inappropriate implementation in Extensions API in Google Chrome prior to 114.0.5735.90 allowed an attacker     who convinced a user to install a malicious extension to spoof the contents of the UI via a crafted Chrome     Extension. (Chromium security severity: Low) (CVE-2023-2941)

  - Type confusion in V8 in Google Chrome prior to 114.0.5735.110 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2023-3079)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Microsoft Edge installed on the remote Windows host is prior to 114.0.1823.37. It is, therefore, affected by multiple vulnerabilities as referenced in the June 2, 2023 advisory.

  - Out of bounds write in Swiftshader in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-2929)

  - Use after free in Extensions in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a     user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
    (Chromium security severity: High) (CVE-2023-2930)

  - Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially     exploit heap corruption via a crafted PDF file. (Chromium security severity: High) (CVE-2023-2931,     CVE-2023-2932, CVE-2023-2933)

  - Out of bounds memory access in Mojo in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-2934)

  - Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2023-2935,     CVE-2023-2936)

  - Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a     remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar)     via a crafted HTML page. (Chromium security severity: Medium) (CVE-2023-2937, CVE-2023-2938)

  - Insufficient data validation in Installer in Google Chrome on Windows prior to 114.0.5735.90 allowed a     local attacker to perform privilege escalation via crafted symbolic link. (Chromium security severity:
    Medium) (CVE-2023-2939)

  - Inappropriate implementation in Downloads in Google Chrome prior to 114.0.5735.90 allowed an attacker who     convinced a user to install a malicious extension to bypass file access restrictions via a crafted HTML     page. (Chromium security severity: Medium) (CVE-2023-2940)

  - Inappropriate implementation in Extensions API in Google Chrome prior to 114.0.5735.90 allowed an attacker     who convinced a user to install a malicious extension to spoof the contents of the UI via a crafted Chrome     Extension. (Chromium security severity: Low) (CVE-2023-2941)

  - Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVE-2023-29345)

  - Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVE-2023-33143)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5418 advisory.

  - Out of bounds write in Swiftshader in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-2929)

  - Use after free in Extensions in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a     user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
    (Chromium security severity: High) (CVE-2023-2930)

  - Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially     exploit heap corruption via a crafted PDF file. (Chromium security severity: High) (CVE-2023-2931,     CVE-2023-2932, CVE-2023-2933)

  - Out of bounds memory access in Mojo in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-2934)

  - Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2023-2935,     CVE-2023-2936)

  - Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a     remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar)     via a crafted HTML page. (Chromium security severity: Medium) (CVE-2023-2937, CVE-2023-2938)

  - Insufficient data validation in Installer in Google Chrome on Windows prior to 114.0.5735.90 allowed a     local attacker to perform privilege escalation via crafted symbolic link. (Chromium security severity:
    Medium) (CVE-2023-2939)

  - Inappropriate implementation in Downloads in Google Chrome prior to 114.0.5735.90 allowed an attacker who     convinced a user to install a malicious extension to bypass file access restrictions via a crafted HTML     page. (Chromium security severity: Medium) (CVE-2023-2940)

  - Inappropriate implementation in Extensions API in Google Chrome prior to 114.0.5735.90 allowed an attacker     who convinced a user to install a malicious extension to spoof the contents of the UI via a crafted Chrome     Extension. (Chromium security severity: Low) (CVE-2023-2941)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the fd87a250-ff78-11ed-8290-a8a1599412c6 advisory.

  - Out of bounds write in Swiftshader in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-2929)

  - Use after free in Extensions in Google Chrome prior to 114.0.5735.90 allowed an attacker who convinced a     user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
    (Chromium security severity: High) (CVE-2023-2930)

  - Use after free in PDF in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially     exploit heap corruption via a crafted PDF file. (Chromium security severity: High) (CVE-2023-2931,     CVE-2023-2932, CVE-2023-2933)

  - Out of bounds memory access in Mojo in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2023-2934)

  - Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2023-2935,     CVE-2023-2936)

  - Inappropriate implementation in Picture In Picture in Google Chrome prior to 114.0.5735.90 allowed a     remote attacker who had compromised the renderer process to spoof the contents of the Omnibox (URL bar)     via a crafted HTML page. (Chromium security severity: Medium) (CVE-2023-2937, CVE-2023-2938)

  - Insufficient data validation in Installer in Google Chrome on Windows prior to 114.0.5735.90 allowed a     local attacker to perform privilege escalation via crafted symbolic link. (Chromium security severity:
    Medium) (CVE-2023-2939)

  - Inappropriate implementation in Downloads in Google Chrome prior to 114.0.5735.90 allowed an attacker who     convinced a user to install a malicious extension to bypass file access restrictions via a crafted HTML     page. (Chromium security severity: Medium) (CVE-2023-2940)

  - Inappropriate implementation in Extensions API in Google Chrome prior to 114.0.5735.90 allowed an attacker     who convinced a user to install a malicious extension to spoof the contents of the UI via a crafted Chrome     Extension. (Chromium security severity: Low) (CVE-2023-2941)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 114.0.5735.90. It is, therefore, affected by multiple vulnerabilities as referenced in the 2023_05_stable-channel-update-for-desktop_30 advisory.

  - Out of bounds write in Swiftshader. (CVE-2023-2929)

  - Use after free in Extensions. (CVE-2023-2930)

  - Use after free in PDF. (CVE-2023-2931, CVE-2023-2932, CVE-2023-2933)

  - Out of bounds memory access in Mojo. (CVE-2023-2934)

  - Type Confusion in V8. (CVE-2023-2935, CVE-2023-2936)

  - Inappropriate implementation in Picture In Picture. (CVE-2023-2937, CVE-2023-2938)

  - Insufficient data validation in Installer. (CVE-2023-2939)

  - Inappropriate implementation in Downloads. (CVE-2023-2940)

  - Inappropriate implementation in Extensions API. (CVE-2023-2941)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 114.0.5735.90. It is, therefore, affected by multiple vulnerabilities as referenced in the 2023_05_stable-channel-update-for-desktop_30 advisory.

  - Out of bounds write in Swiftshader. (CVE-2023-2929)

  - Use after free in Extensions. (CVE-2023-2930)

  - Use after free in PDF. (CVE-2023-2931, CVE-2023-2932, CVE-2023-2933)

  - Out of bounds memory access in Mojo. (CVE-2023-2934)

  - Type Confusion in V8. (CVE-2023-2935, CVE-2023-2936)

  - Inappropriate implementation in Picture In Picture. (CVE-2023-2937, CVE-2023-2938)

  - Insufficient data validation in Installer. (CVE-2023-2939)

  - Inappropriate implementation in Downloads. (CVE-2023-2940)

  - Inappropriate implementation in Extensions API. (CVE-2023-2941)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 114.0.5735.91. It is, therefore, affected by multiple vulnerabilities as referenced in the 2023_05_stable-channel-update-for-desktop_30 advisory.

  - Out of bounds write in Swiftshader. (CVE-2023-2929)

  - Use after free in Extensions. (CVE-2023-2930)

  - Use after free in PDF. (CVE-2023-2931, CVE-2023-2932, CVE-2023-2933)

  - Out of bounds memory access in Mojo. (CVE-2023-2934)

  - Type Confusion in V8. (CVE-2023-2935, CVE-2023-2936)

  - Inappropriate implementation in Picture In Picture. (CVE-2023-2937, CVE-2023-2938)

  - Insufficient data validation in Installer. (CVE-2023-2939)

  - Inappropriate implementation in Downloads. (CVE-2023-2940)

  - Inappropriate implementation in Extensions API. (CVE-2023-2941)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
189844	GLSA-202401-34 : Chromium, Google Chrome, Microsoft Edge: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
186268	GLSA-202311-11 : QtWebEngine: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	high
177098	openSUSE 15 Security Update : chromium (openSUSE-SU-2023:0124-1)	Nessus	SuSE Local Security Checks	high
176816	Microsoft Edge (Chromium) < 114.0.1823.37 Multiple Vulnerabilities	Nessus	Windows	high
176662	Debian DSA-5418-1 : chromium - security update	Nessus	Debian Local Security Checks	high
176529	FreeBSD : chromium -- multiple vulnerabilities (fd87a250-ff78-11ed-8290-a8a1599412c6)	Nessus	FreeBSD Local Security Checks	high
176496	Google Chrome < 114.0.5735.90 Multiple Vulnerabilities	Nessus	Windows	high
176495	Google Chrome < 114.0.5735.90 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	high
176494	Google Chrome < 114.0.5735.91 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2023-2940

medium

Tenable Plugins

critical

high

high

high

high

high

high

high

high