The remote host is affected by the vulnerability described in GLSA-202209-23 (Chromium, Google Chrome, Microsoft Edge:
Multiple Vulnerabilities)

  - Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2022-3038)

  - Use after free in WebSQL in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2022-3039, CVE-2022-3041)

  - Use after free in Layout in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2022-3040)

  - Use after free in PhoneHub in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker     to potentially exploit heap corruption via a crafted HTML page. (CVE-2022-3042)

  - Heap buffer overflow in Screen Capture in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a     remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap     corruption via a crafted HTML page. (CVE-2022-3043)

  - Inappropriate implementation in Site Isolation in Google Chrome prior to 105.0.5195.52 allowed a remote     attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
    (CVE-2022-3044)

  - Insufficient validation of untrusted input in V8 in Google Chrome prior to 105.0.5195.52 allowed a remote     attacker to potentially exploit heap corruption via a crafted HTML page. (CVE-2022-3045)

  - Use after free in Browser Tag in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a     user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2022-3046)

  - Insufficient policy enforcement in Extensions API in Google Chrome prior to 105.0.5195.52 allowed an     attacker who convinced a user to install a malicious extension to bypass downloads policy via a crafted     HTML page. (CVE-2022-3047)

  - Inappropriate implementation in Chrome OS lockscreen in Google Chrome on Chrome OS prior to 105.0.5195.52     allowed a local attacker to bypass lockscreen navigation restrictions via physical access to the device.
    (CVE-2022-3048)

  - Use after free in SplitScreen in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a     remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap     corruption via a crafted HTML page. (CVE-2022-3049)

  - Heap buffer overflow in WebUI in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote     attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption     via crafted UI interactions. (CVE-2022-3050)

  - Heap buffer overflow in Exosphere in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a     remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap     corruption via crafted UI interactions. (CVE-2022-3051)

  - Heap buffer overflow in Window Manager in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52     allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially     exploit heap corruption via crafted UI interactions. (CVE-2022-3052)

  - Inappropriate implementation in Pointer Lock in Google Chrome on Mac prior to 105.0.5195.52 allowed a     remote attacker to restrict user navigation via a crafted HTML page. (CVE-2022-3053)

  - Insufficient policy enforcement in DevTools in Google Chrome prior to 105.0.5195.52 allowed a remote     attacker to potentially exploit heap corruption via a crafted HTML page. (CVE-2022-3054)

  - Use after free in Passwords in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who     convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a     crafted HTML page. (CVE-2022-3055)

  - Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 105.0.5195.52 allowed     a remote attacker to bypass content security policy via a crafted HTML page. (CVE-2022-3056)

  - Inappropriate implementation in iframe Sandbox in Google Chrome prior to 105.0.5195.52 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2022-3057)

  - Use after free in Sign-In Flow in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who     convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted     UI interaction. (CVE-2022-3058)

  - Use after free in Tab Strip in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote     attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption     via crafted UI interaction. (CVE-2022-3071)

  - Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker     who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2022-3075)

  - Out of bounds write in Storage in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to     perform an out of bounds memory write via a crafted HTML page. (CVE-2022-3195)

  - Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially     exploit heap corruption via a crafted PDF file. (CVE-2022-3196, CVE-2022-3197, CVE-2022-3198)

  - Use after free in Frames in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2022-3199)

  - Heap buffer overflow in Internals in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2022-3200)

  - Insufficient validation of untrusted input in DevTools in Google Chrome on Chrome OS prior to     105.0.5195.125 allowed an attacker who convinced a user to install a malicious extension to bypass     navigation restrictions via a crafted HTML page. (CVE-2022-3201)

  - Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability. (CVE-2022-38012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

GLSA-202209-23 : Chromium, Google Chrome, Microsoft Edge: Multiple Vulnerabilities

critical Nessus Plugin ID 165535

Version 1.9

Version 1.8

Version 1.7

Version 1.6

Version 1.5

Version 1.9 Oct 10, 2023, 4:16 PM CVSS metrics ("CVSSv3 score" changed from 8.8 to 9.6. "CVSSv3 vector" changed from "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H" to "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H") CVSSv2 score source (changed from "CVE-2022-3199" to "CVE-2022-3200") CVSSv3 score source (changed from "CVE-2022-3200" to "CVE-2022-3075") Plugin Feed: 202310101616
Version 1.8 Mar 30, 2023, 10:08 PM CISA reference Plugin Feed: 202303302208
Version 1.7 Nov 21, 2022, 6:04 PM CISA reference IAVM reference Plugin Feed: 202211211804
Version 1.6 Oct 18, 2022, 10:07 AM IAVM reference CISA reference Plugin Feed: 202210181007
Version 1.5 Oct 11, 2022, 10:05 AM CISA reference IAVM reference Plugin Feed: 202210111005