The version of Microsoft Edge installed on the remote Windows host is prior to 126.0.2592.56. It is, therefore, affected by multiple vulnerabilities as referenced in the June 13, 2024 advisory.

  - Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVE-2024-30058, CVE-2024-38083)

  - Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform an out     of bounds memory write via a crafted HTML page. (Chromium security severity: High) (CVE-2024-5830)

  - Use after free in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2024-5831,     CVE-2024-5832)

  - Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially     perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)     (CVE-2024-5833, CVE-2024-5837)

  - Inappropriate implementation in Dawn in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to     execute arbitrary code via a crafted HTML page. (Chromium security severity: High) (CVE-2024-5834)

  - Heap buffer overflow in Tab Groups in Google Chrome prior to 126.0.6478.54 allowed a remote attacker who     convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted     HTML page. (Chromium security severity: High) (CVE-2024-5835)

  - Inappropriate Implementation in DevTools in Google Chrome prior to 126.0.6478.54 allowed an attacker who     convinced a user to install a malicious extension to execute arbitrary code via a crafted Chrome     Extension. (Chromium security severity: High) (CVE-2024-5836)

  - Type Confusion in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to perform out of     bounds memory access via a crafted HTML page. (Chromium security severity: High) (CVE-2024-5838)

  - Inappropriate Implementation in Memory Allocator in Google Chrome prior to 126.0.6478.54 allowed a remote     attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity:
    Medium) (CVE-2024-5839)

  - Policy bypass in CORS in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to bypass     discretionary access control via a crafted HTML page. (Chromium security severity: Medium) (CVE-2024-5840)

  - Use after free in V8 in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) (CVE-2024-5841)

  - Use after free in Browser UI in Google Chrome prior to 126.0.6478.54 allowed a remote attacker who     convinced a user to engage in specific UI gestures to perform an out of bounds memory read via a crafted     HTML page. (Chromium security severity: Medium) (CVE-2024-5842)

  - Inappropriate implementation in Downloads in Google Chrome prior to 126.0.6478.54 allowed a remote     attacker to obfuscate security UI via a malicious file. (Chromium security severity: Medium)     (CVE-2024-5843)

  - Heap buffer overflow in Tab Strip in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to     perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)     (CVE-2024-5844)

  - Use after free in Audio in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially     exploit heap corruption via a crafted PDF file. (Chromium security severity: Medium) (CVE-2024-5845)

  - Use after free in PDFium in Google Chrome prior to 126.0.6478.54 allowed a remote attacker to potentially     exploit heap corruption via a crafted PDF file. (Chromium security severity: Medium) (CVE-2024-5846,     CVE-2024-5847)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Microsoft Edge (Chromium) < 126.0.2592.56 Multiple Vulnerabilities

high Nessus Plugin ID 200498

Version 1.3