The version of Google Chrome installed on the remote macOS host is prior to 125.0.6422.141. It is, therefore, affected by multiple vulnerabilities as referenced in the 2024_05_stable-channel-update-for-desktop_30 advisory.

  - Heap buffer overflow in WebRTC in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2024-5493)

  - Use after free in Dawn in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2024-5494,     CVE-2024-5495)

  - Use after free in Media Session in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to     execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2024-5496)

  - Out of bounds memory access in Browser UI in Google Chrome prior to 125.0.6422.141 allowed a remote     attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via     a crafted HTML page. (Chromium security severity: High) (CVE-2024-5497)

  - Use after free in Presentation API in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2024-5498)

  - Out of bounds write in Streams API in Google Chrome prior to 125.0.6422.141 allowed a remote attacker to     execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2024-5499)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Google Chrome < 125.0.6422.141 Multiple Vulnerabilities

high Nessus Plugin ID 198162

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.5 Nov 1, 2024, 3:44 PM CVSS metrics ("CVSSv3 score" set to 8.8) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H") CVSSv3 score source (set to "CVE-2024-5499") Plugin Feed: 202411011544
Version 1.4 Jun 14, 2024, 2:32 PM IAVM reference Plugin Feed: 202406141432
Version 1.3 Jun 8, 2024, 1:32 AM Plugin metadata Plugin Feed: 202406080132
Version 1.2 Jun 7, 2024, 9:18 AM IAVM reference STIG Severity (set to "I") Plugin Feed: 202406070918
Version 1.1 May 30, 2024, 10:11 PM New Plugin Feed: 202405302211