The version of Google Chrome installed on the remote macOS host is prior to 126.0.6478.56. It is, therefore, affected by multiple vulnerabilities as referenced in the 2024_06_stable-channel-update-for-desktop advisory.

  - Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform an out     of bounds memory write via a crafted HTML page. (Chromium security severity: High) (CVE-2024-5830)

  - Use after free in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2024-5831)

  - Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially     perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)     (CVE-2024-5833)

  - Inappropriate implementation in Downloads in Google Chrome prior to 126.0.6478.54 allowed a remote     attacker to obfuscate security UI via a malicious file. (Chromium security severity: Medium)     (CVE-2024-5843)

  - Use after free in Dawn. (CVE-2024-5832)

  - Inappropriate implementation in Dawn. (CVE-2024-5834)

  - Heap buffer overflow in Tab Groups. (CVE-2024-5835)

  - Inappropriate Implementation in DevTools. (CVE-2024-5836)

  - Type Confusion in V8. (CVE-2024-5837, CVE-2024-5838)

  - Inappropriate Implementation in Memory Allocator. (CVE-2024-5839)

  - Policy Bypass in CORS. (CVE-2024-5840)

  - Use after free in V8. (CVE-2024-5841)

  - Use after free in Browser UI. (CVE-2024-5842)

  - Heap buffer overflow in Tab Strip. (CVE-2024-5844)

  - Use after free in Audio. (CVE-2024-5845)

  - Use after free in PDFium. (CVE-2024-5846, CVE-2024-5847)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Google Chrome < 126.0.6478.56 Multiple Vulnerabilities

high Nessus Plugin ID 200330

Version 1.6

Version 1.5

Version 1.3

Version 1.2

Version 1.6 Aug 16, 2024, 7:34 AM CVSS temporal metrics ("CVSSv2 temporal vector" set to "CVSS2#E:POC/RL:OF/RC:C") CVSS temporal metrics ("CVSSv3 temporal vector" set to "CVSS:3.0/E:P/RL:O/RC:C") Exploit attributes ("Exploit available" set to "True") Exploit attributes ("Exploitability ease" changed from "No known exploits are available" to "Exploits are available") Plugin Feed: 202408160734
Version 1.5 Jun 21, 2024, 2:16 PM CVSS metrics ("CVSSv3 score" set to 8.8. "CVSSv3 vector" set to "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H") IAVM reference Plugin Feed: 202406211416
Version 1.3 Jun 14, 2024, 2:32 PM IAVM reference STIG Severity (set to "I") Plugin Feed: 202406141432
Version 1.2 Jun 11, 2024, 11:55 PM New Plugin metadata Plugin Feed: 202406112355