Use after free in Thumbnail Tab Strip in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

The version of Google Chrome installed on the remote Windows host is prior to 98.0.4758.82. It is, therefore, affected by multiple vulnerabilities as referenced in the 2022_02_stable-channel-update-for-desktop advisory.

  - Out of bounds memory access in V8 in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2022-0470)

  - Inappropriate implementation in Extensions Platform in Google Chrome prior to 98.0.4758.80 allowed an     attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via     a crafted HTML page. (CVE-2022-0466)

  - Use after free in Safe Browsing in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (CVE-2022-0452)

  - Use after free in Reader Mode in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2022-0453)

  - Heap buffer overflow in ANGLE in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2022-0454)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 98.0.4758.81. It is, therefore, affected by multiple vulnerabilities as referenced in the 2022_02_stable-channel-update-for-desktop advisory.

  - Out of bounds memory access in V8 in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2022-0470)

  - Inappropriate implementation in Extensions Platform in Google Chrome prior to 98.0.4758.80 allowed an     attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via     a crafted HTML page. (CVE-2022-0466)

  - Use after free in Safe Browsing in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (CVE-2022-0452)

  - Use after free in Reader Mode in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2022-0453)

  - Heap buffer overflow in ANGLE in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2022-0454)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 98.0.4758.81. It is, therefore, affected by multiple vulnerabilities as referenced in the 2022_02_stable-channel-update-for-desktop advisory.

  - Out of bounds memory access in V8 in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2022-0470)

  - Inappropriate implementation in Extensions Platform in Google Chrome prior to 98.0.4758.80 allowed an     attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via     a crafted HTML page. (CVE-2022-0466)

  - Use after free in Safe Browsing in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (CVE-2022-0452)

  - Use after free in Reader Mode in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2022-0453)

  - Heap buffer overflow in ANGLE in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2022-0454)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - Inappropriate implementation in Gamepad API in Google Chrome prior to 98.0.4758.102 allowed a remote
    attacker to potentially exploit heap corruption via a crafted HTML page. (CVE-2022-0610)

  - Use after free in Safe Browsing in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to
    potentially perform a sandbox escape via a crafted HTML page. (CVE-2022-0452)

  - Use after free in Reader Mode in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had
    compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2022-0453)

  - Heap buffer overflow in ANGLE in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to
    potentially exploit heap corruption via a crafted HTML page. (CVE-2022-0454)

  - Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 98.0.4758.80 allowed
    a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2022-0455)

The remote host is affected by the vulnerability described in GLSA-202202-02 (Chromium, Google Chrome: Multiple vulnerabilities)

  - Use after free in Animation in Google Chrome prior to 98.0.4758.102 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2022-0609)

  - Use after free in Safe Browsing in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (CVE-2022-0452)

  - Use after free in Reader Mode in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2022-0453)

  - Heap buffer overflow in ANGLE in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2022-0454)

  - Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 98.0.4758.80 allowed     a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2022-0455)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5068 advisory.

  - Out of bounds memory access in V8 in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2022-0470)

  - Use after free in Safe Browsing in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (CVE-2022-0452)

  - Use after free in Reader Mode in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2022-0453)

  - Heap buffer overflow in ANGLE in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2022-0454)

  - Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 98.0.4758.80 allowed     a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2022-0455)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the e852f43c-846e-11ec-b043-3065ec8fd3ec advisory.

  - Out of bounds memory access in V8 in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2022-0470)

  - Use after free in Safe Browsing in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (CVE-2022-0452)

  - Use after free in Reader Mode in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2022-0453)

  - Heap buffer overflow in ANGLE in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2022-0454)

  - Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 98.0.4758.80 allowed     a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (CVE-2022-0455)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 98.0.4758.80. It is, therefore, affected by multiple vulnerabilities as referenced in the 2022_02_stable-channel-update-for-desktop advisory.

  - Out of bounds memory access in V8 in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2022-0470)

  - Inappropriate implementation in Extensions Platform in Google Chrome prior to 98.0.4758.80 allowed an     attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via     a crafted HTML page. (CVE-2022-0466)

  - Use after free in Safe Browsing in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (CVE-2022-0452)

  - Use after free in Reader Mode in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2022-0453)

  - Heap buffer overflow in ANGLE in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2022-0454)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 98.0.4758.80. It is, therefore, affected by multiple vulnerabilities as referenced in the 2022_02_stable-channel-update-for-desktop advisory.

  - Out of bounds memory access in V8 in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2022-0470)

  - Inappropriate implementation in Extensions Platform in Google Chrome prior to 98.0.4758.80 allowed an     attacker who convinced a user to install a malicious extension to potentially perform a sandbox escape via     a crafted HTML page. (CVE-2022-0466)

  - Use after free in Safe Browsing in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (CVE-2022-0452)

  - Use after free in Reader Mode in Google Chrome prior to 98.0.4758.80 allowed a remote attacker who had     compromised the renderer process to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2022-0453)

  - Heap buffer overflow in ANGLE in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2022-0454)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
276661	Google Chrome < 98.0.4758.82 Multiple Vulnerabilities	Nessus	Windows	critical
276660	Google Chrome < 98.0.4758.81 Multiple Vulnerabilities	Nessus	Windows	critical
276659	Google Chrome < 98.0.4758.81 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
403830	Alpine: multiple chromium packages: security update to 99.0.4844.84-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
403830	Alpine: multiple chromium packages: security update to 99.0.4844.84-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
403829	Alpine: multiple chromium packages: security update to 98.0.4758.102-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	critical
403829	Alpine: multiple chromium packages: security update to 98.0.4758.102-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	critical
158198	GLSA-202202-02 : Chromium, Google Chrome: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
157447	Debian DSA-5068-1 : chromium - security update	Nessus	Debian Local Security Checks	critical
157332	FreeBSD : chromium -- multiple vulnerabilities (e852f43c-846e-11ec-b043-3065ec8fd3ec)	Nessus	FreeBSD Local Security Checks	critical
157293	Google Chrome < 98.0.4758.80 Multiple Vulnerabilities	Nessus	Windows	critical
157292	Google Chrome < 98.0.4758.80 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical

Detections

Analytics

CVE-2022-0458

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical