Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability

The remote host is affected by the vulnerability described in GLSA-202209-23 (Chromium, Google Chrome, Microsoft Edge:
Multiple Vulnerabilities)

  - Use after free in Network Service in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2022-3038)

  - Use after free in WebSQL in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2022-3039, CVE-2022-3041)

  - Use after free in Layout in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2022-3040)

  - Use after free in PhoneHub in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote attacker     to potentially exploit heap corruption via a crafted HTML page. (CVE-2022-3042)

  - Heap buffer overflow in Screen Capture in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a     remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap     corruption via a crafted HTML page. (CVE-2022-3043)

  - Inappropriate implementation in Site Isolation in Google Chrome prior to 105.0.5195.52 allowed a remote     attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.
    (CVE-2022-3044)

  - Insufficient validation of untrusted input in V8 in Google Chrome prior to 105.0.5195.52 allowed a remote     attacker to potentially exploit heap corruption via a crafted HTML page. (CVE-2022-3045)

  - Use after free in Browser Tag in Google Chrome prior to 105.0.5195.52 allowed an attacker who convinced a     user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.
    (CVE-2022-3046)

  - Insufficient policy enforcement in Extensions API in Google Chrome prior to 105.0.5195.52 allowed an     attacker who convinced a user to install a malicious extension to bypass downloads policy via a crafted     HTML page. (CVE-2022-3047)

  - Inappropriate implementation in Chrome OS lockscreen in Google Chrome on Chrome OS prior to 105.0.5195.52     allowed a local attacker to bypass lockscreen navigation restrictions via physical access to the device.
    (CVE-2022-3048)

  - Use after free in SplitScreen in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a     remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap     corruption via a crafted HTML page. (CVE-2022-3049)

  - Heap buffer overflow in WebUI in Google Chrome on Chrome OS prior to 105.0.5195.52 allowed a remote     attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption     via crafted UI interactions. (CVE-2022-3050)

  - Heap buffer overflow in Exosphere in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a     remote attacker who convinced a user to engage in specific UI interactions to potentially exploit heap     corruption via crafted UI interactions. (CVE-2022-3051)

  - Heap buffer overflow in Window Manager in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52     allowed a remote attacker who convinced a user to engage in specific UI interactions to potentially     exploit heap corruption via crafted UI interactions. (CVE-2022-3052)

  - Inappropriate implementation in Pointer Lock in Google Chrome on Mac prior to 105.0.5195.52 allowed a     remote attacker to restrict user navigation via a crafted HTML page. (CVE-2022-3053)

  - Insufficient policy enforcement in DevTools in Google Chrome prior to 105.0.5195.52 allowed a remote     attacker to potentially exploit heap corruption via a crafted HTML page. (CVE-2022-3054)

  - Use after free in Passwords in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who     convinced a user to engage in specific UI interactions to potentially exploit heap corruption via a     crafted HTML page. (CVE-2022-3055)

  - Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 105.0.5195.52 allowed     a remote attacker to bypass content security policy via a crafted HTML page. (CVE-2022-3056)

  - Inappropriate implementation in iframe Sandbox in Google Chrome prior to 105.0.5195.52 allowed a remote     attacker to leak cross-origin data via a crafted HTML page. (CVE-2022-3057)

  - Use after free in Sign-In Flow in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who     convinced a user to engage in specific UI interactions to potentially exploit heap corruption via crafted     UI interaction. (CVE-2022-3058)

  - Use after free in Tab Strip in Google Chrome on Chrome OS, Lacros prior to 105.0.5195.52 allowed a remote     attacker who convinced a user to engage in specific UI interactions to potentially exploit heap corruption     via crafted UI interaction. (CVE-2022-3071)

  - Insufficient data validation in Mojo in Google Chrome prior to 105.0.5195.102 allowed a remote attacker     who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (CVE-2022-3075)

  - Out of bounds write in Storage in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to     perform an out of bounds memory write via a crafted HTML page. (CVE-2022-3195)

  - Use after free in PDF in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially     exploit heap corruption via a crafted PDF file. (CVE-2022-3196, CVE-2022-3197, CVE-2022-3198)

  - Use after free in Frames in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (CVE-2022-3199)

  - Heap buffer overflow in Internals in Google Chrome prior to 105.0.5195.125 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (CVE-2022-3200)

  - Insufficient validation of untrusted input in DevTools in Google Chrome on Chrome OS prior to     105.0.5195.125 allowed an attacker who convinced a user to install a malicious extension to bypass     navigation restrictions via a crafted HTML page. (CVE-2022-3201)

  - Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability. (CVE-2022-38012)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Microsoft Edge installed on the remote Windows host is prior to 105.0.1343.25. It is, therefore, affected by multiple vulnerabilities as referenced in the September 1, 2022 advisory.

  - Use after free in Network Service. (CVE-2022-3038)

  - Use after free in WebSQL. (CVE-2022-3039, CVE-2022-3041)

  - Use after free in Layout. (CVE-2022-3040)

  - Inappropriate implementation in Site Isolation. (CVE-2022-3044)

  - Insufficient validation of untrusted input in V8. (CVE-2022-3045)

  - Use after free in Browser Tag. (CVE-2022-3046)

  - Insufficient policy enforcement in Extensions API. (CVE-2022-3047)

  - Inappropriate implementation in Pointer Lock. (CVE-2022-3053)

  - Insufficient policy enforcement in DevTools. (CVE-2022-3054)

  - Use after free in Passwords. (CVE-2022-3055)

  - Insufficient policy enforcement in Content Security Policy. (CVE-2022-3056)

  - Inappropriate implementation in iframe Sandbox. (CVE-2022-3057)

  - Use after free in Sign-In Flow. (CVE-2022-3058)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
165535	GLSA-202209-23 : Chromium, Google Chrome, Microsoft Edge: Multiple Vulnerabilities	Nessus	Gentoo Local Security Checks	critical
164638	Microsoft Edge (Chromium) < 105.0.1343.25 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2022-38012

high

Tenable Plugins

critical

high