The version of Google Chrome installed on the remote Windows host is prior to 87.0.4280.66. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_11_stable-channel-update-for-desktop_17 advisory.

  - Use after free in payments in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16018)

  - Inappropriate implementation in filesystem in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a     remote attacker who had compromised the browser process to bypass noexec restrictions via a malicious     file. (CVE-2020-16019)

  - Inappropriate implementation in cryptohome in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a     remote attacker who had compromised the browser process to bypass discretionary access control via a     malicious file. (CVE-2020-16020)

  - Race in image burner in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had     compromised the browser process to perform OS-level privilege escalation via a malicious file.
    (CVE-2020-16021)

  - Insufficient policy enforcement in networking in Google Chrome prior to 87.0.4280.66 allowed a remote     attacker to potentially bypass firewall controls via a crafted HTML page. (CVE-2020-16022)

  - Insufficient data validation in WASM in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-16015)

  - Use after free in PPAPI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16014)

  - Use after free in WebCodecs in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-16023)

  - Heap buffer overflow in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16024)

  - Heap buffer overflow in clipboard in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16025)

  - Use after Free in Payments in Google Chrome on Android prior to 87.0.4280.66 allowed a remote attacker who     had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16045)

  - Use after free in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-16026)

  - Insufficient policy enforcement in developer tools in Google Chrome prior to 87.0.4280.66 allowed an     attacker who convinced a user to install a malicious extension to obtain potentially sensitive information     from the user's disk via a crafted Chrome Extension. (CVE-2020-16027)

  - Heap buffer overflow in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-16028)

  - Inappropriate implementation in PDFium in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     bypass navigation restrictions via a crafted PDF file. (CVE-2020-16029)

  - Insufficient data validation in Blink in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (CVE-2020-16030)

  - Adobe Flash Player version 32.0.0.192 and earlier versions have a Same Origin Policy Bypass vulnerability.
    Successful exploitation could lead to Information Disclosure in the context of the current user.
    (CVE-2019-8075)

  - Insufficient data validation in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2020-16031)

  - Insufficient data validation in sharing in Google Chrome prior to 87.0.4280.66 allowed a remote attacker     to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2020-16032)

  - Inappropriate implementation in WebUSB in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     spoof security UI via a crafted HTML page. (CVE-2020-16033)

  - Inappropriate implementation in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a local attacker to     bypass policy restrictions via a crafted HTML page. (CVE-2020-16034)

  - Insufficient data validation in cros-disks in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a     remote attacker who had compromised the browser process to bypass noexec restrictions via a malicious     file. (CVE-2020-16035)

  - Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2020-16012)

  - Inappropriate implementation in cookies in Google Chrome prior to 87.0.4280.66 allowed a remote attacker     to bypass cookie restrictions via a crafted HTML page. (CVE-2020-16036)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 87.0.4280.67. It is, therefore, affected by multiple vulnerabilities as referenced in the 2020_11_stable-channel-update-for-desktop_17 advisory.

  - Use after free in payments in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16018)

  - Inappropriate implementation in filesystem in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a     remote attacker who had compromised the browser process to bypass noexec restrictions via a malicious     file. (CVE-2020-16019)

  - Inappropriate implementation in cryptohome in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a     remote attacker who had compromised the browser process to bypass discretionary access control via a     malicious file. (CVE-2020-16020)

  - Race in image burner in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a remote attacker who had     compromised the browser process to perform OS-level privilege escalation via a malicious file.
    (CVE-2020-16021)

  - Insufficient policy enforcement in networking in Google Chrome prior to 87.0.4280.66 allowed a remote     attacker to potentially bypass firewall controls via a crafted HTML page. (CVE-2020-16022)

  - Insufficient data validation in WASM in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-16015)

  - Use after free in PPAPI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16014)

  - Use after free in WebCodecs in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-16023)

  - Heap buffer overflow in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16024)

  - Heap buffer overflow in clipboard in Google Chrome prior to 87.0.4280.66 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16025)

  - Use after Free in Payments in Google Chrome on Android prior to 87.0.4280.66 allowed a remote attacker who     had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2020-16045)

  - Use after free in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2020-16026)

  - Insufficient policy enforcement in developer tools in Google Chrome prior to 87.0.4280.66 allowed an     attacker who convinced a user to install a malicious extension to obtain potentially sensitive information     from the user's disk via a crafted Chrome Extension. (CVE-2020-16027)

  - Heap buffer overflow in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2020-16028)

  - Inappropriate implementation in PDFium in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     bypass navigation restrictions via a crafted PDF file. (CVE-2020-16029)

  - Insufficient data validation in Blink in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. (CVE-2020-16030)

  - Adobe Flash Player version 32.0.0.192 and earlier versions have a Same Origin Policy Bypass vulnerability.
    Successful exploitation could lead to Information Disclosure in the context of the current user.
    (CVE-2019-8075)

  - Insufficient data validation in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2020-16031)

  - Insufficient data validation in sharing in Google Chrome prior to 87.0.4280.66 allowed a remote attacker     to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2020-16032)

  - Inappropriate implementation in WebUSB in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to     spoof security UI via a crafted HTML page. (CVE-2020-16033)

  - Inappropriate implementation in WebRTC in Google Chrome prior to 87.0.4280.66 allowed a local attacker to     bypass policy restrictions via a crafted HTML page. (CVE-2020-16034)

  - Insufficient data validation in cros-disks in Google Chrome on ChromeOS prior to 87.0.4280.66 allowed a     remote attacker who had compromised the browser process to bypass noexec restrictions via a malicious     file. (CVE-2020-16035)

  - Side-channel information leakage in graphics in Google Chrome prior to 87.0.4280.66 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2020-16012)

  - Inappropriate implementation in cookies in Google Chrome prior to 87.0.4280.66 allowed a remote attacker     to bypass cookie restrictions via a crafted HTML page. (CVE-2020-16036)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
142971	Google Chrome < 87.0.4280.66 Multiple Vulnerabilities	Nessus	Windows	11/17/2020	10/23/2024	critical
209562	Google Chrome < 87.0.4280.67 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	10/23/2024	10/23/2024	critical

Detections

Analytics

Plugins Search

critical

critical