Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6553 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6553-1                   security@debian.org     https://www.debian.org/security/                           Andres Salomon     October 12, 2026                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : chromium     CVE ID         : CVE-2026-102322 CVE-2026-103621 CVE-2026-103622 CVE-2026-103623                      CVE-2026-103624 CVE-2026-103625 CVE-2026-103626 CVE-2026-103627                      CVE-2026-103628 CVE-2026-103629 CVE-2026-103630 CVE-2026-103631                      CVE-2026-106179 CVE-2026-106180 CVE-2026-106181 CVE-2026-106182                      CVE-2026-106183 CVE-2026-106184 CVE-2026-106185 CVE-2026-106186                      CVE-2026-106187 CVE-2026-106188 CVE-2026-106189 CVE-2026-106190                      CVE-2026-106191 CVE-2026-106192 CVE-2026-106193 CVE-2026-106194                      CVE-2026-106195 CVE-2026-106196 CVE-2026-106197 CVE-2026-106198                      CVE-2026-106199 CVE-2026-106200 CVE-2026-106201 CVE-2026-106202                      CVE-2026-106203 CVE-2026-106204 CVE-2026-106205 CVE-2026-106206                      CVE-2026-106207 CVE-2026-106208 CVE-2026-106209 CVE-2026-106210                      CVE-2026-106211 CVE-2026-106212 CVE-2026-106213 CVE-2026-106214                      CVE-2026-106215 CVE-2026-106216 CVE-2026-106217 CVE-2026-106220                      CVE-2026-106221 CVE-2026-106222 CVE-2026-106223 CVE-2026-106224                      CVE-2026-106225 CVE-2026-106226 CVE-2026-106227 CVE-2026-106228                      CVE-2026-106229 CVE-2026-106230 CVE-2026-106231 CVE-2026-106232                      CVE-2026-106233 CVE-2026-106234 CVE-2026-106235 CVE-2026-106236                      CVE-2026-106237 CVE-2026-106238 CVE-2026-106239 CVE-2026-106240                      CVE-2026-106241 CVE-2026-106242 CVE-2026-106243 CVE-2026-106244                      CVE-2026-106245 CVE-2026-106246 CVE-2026-106247 CVE-2026-106248                      CVE-2026-106249 CVE-2026-106250 CVE-2026-106251 CVE-2026-106252                      CVE-2026-106253 CVE-2026-106254 CVE-2026-106255 CVE-2026-106256                      CVE-2026-106257 CVE-2026-106258 CVE-2026-106259 CVE-2026-106260                      CVE-2026-106261 CVE-2026-106262 CVE-2026-106263 CVE-2026-106264                      CVE-2026-106265 CVE-2026-106266 CVE-2026-106267 CVE-2026-106268                      CVE-2026-106269 CVE-2026-106270 CVE-2026-106271 CVE-2026-106272                      CVE-2026-106273 CVE-2026-106274 CVE-2026-106275 CVE-2026-106276                      CVE-2026-106277 CVE-2026-106278 CVE-2026-106279 CVE-2026-106280                      CVE-2026-106281 CVE-2026-106282 CVE-2026-106283 CVE-2026-106284                      CVE-2026-106285 CVE-2026-106286 CVE-2026-106287 CVE-2026-106288                      CVE-2026-106289 CVE-2026-106290 CVE-2026-106291 CVE-2026-106292                      CVE-2026-106293 CVE-2026-106294 CVE-2026-106295 CVE-2026-106296                      CVE-2026-106297 CVE-2026-106298 CVE-2026-106299 CVE-2026-106300                      CVE-2026-106301 CVE-2026-106302 CVE-2026-106303 CVE-2026-106304                      CVE-2026-106305 CVE-2026-106306 CVE-2026-106307 CVE-2026-106308                      CVE-2026-106309 CVE-2026-106310 CVE-2026-106311 CVE-2026-106312                      CVE-2026-106313 CVE-2026-106314 CVE-2026-106315 CVE-2026-106316                      CVE-2026-106317 CVE-2026-106318 CVE-2026-106320 CVE-2026-106321                      CVE-2026-106322 CVE-2026-106323 CVE-2026-106324 CVE-2026-106325                      CVE-2026-106326 CVE-2026-106327 CVE-2026-106328 CVE-2026-106329                      CVE-2026-106330 CVE-2026-106331 CVE-2026-106332 CVE-2026-106333                      CVE-2026-106334 CVE-2026-106335 CVE-2026-106336 CVE-2026-106337                      CVE-2026-106338 CVE-2026-106339 CVE-2026-106340 CVE-2026-106341                      CVE-2026-106342 CVE-2026-106343 CVE-2026-106344 CVE-2026-106345                      CVE-2026-106346 CVE-2026-106347 CVE-2026-106348 CVE-2026-106349                      CVE-2026-106350 CVE-2026-106351 CVE-2026-106352 CVE-2026-106353                      CVE-2026-106354 CVE-2026-106355 CVE-2026-106356 CVE-2026-106357                      CVE-2026-106358 CVE-2026-106359 CVE-2026-106360 CVE-2026-106361                      CVE-2026-106362 CVE-2026-106363 CVE-2026-106364 CVE-2026-106365                      CVE-2026-106366 CVE-2026-106367 CVE-2026-106368 CVE-2026-106369                      CVE-2026-106370 CVE-2026-106371 CVE-2026-106372 CVE-2026-106373                      CVE-2026-106374 CVE-2026-106375 CVE-2026-106376 CVE-2026-106377                      CVE-2026-106378 CVE-2026-106379 CVE-2026-106380 CVE-2026-106381                      CVE-2026-106382 CVE-2026-106383 CVE-2026-106384 CVE-2026-106385                      CVE-2026-106386 CVE-2026-106387 CVE-2026-106388 CVE-2026-106389                      CVE-2026-106390 CVE-2026-106391 CVE-2026-106392 CVE-2026-106393                      CVE-2026-106394 CVE-2026-106395 CVE-2026-106396 CVE-2026-106397                      CVE-2026-106398 CVE-2026-106399 CVE-2026-106400 CVE-2026-106401                      CVE-2026-106402 CVE-2026-106403 CVE-2026-106404 CVE-2026-106405                      CVE-2026-106406 CVE-2026-106407 CVE-2026-106408 CVE-2026-106409                      CVE-2026-106410 CVE-2026-106411 CVE-2026-106412 CVE-2026-106413                      CVE-2026-106414 CVE-2026-106415 CVE-2026-106416 CVE-2026-106417                      CVE-2026-106418 CVE-2026-106419 CVE-2026-106420 CVE-2026-106421                      CVE-2026-106422 CVE-2026-106423 CVE-2026-106424 CVE-2026-106425                      CVE-2026-106426 CVE-2026-106427

    Security issues were discovered in Chromium which could result     in the execution of arbitrary code, denial of service, or information     disclosure.

    For the stable distribution (trixie), these problems have been fixed in     version 155.0.8059.39-1~deb13u1.

    We recommend that you upgrade your chromium packages.

    For the detailed security status of chromium please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/chromium

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4833 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4833-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     October 13, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : chromium     Version        : 155.0.8059.39-1~deb12u1     CVE ID         : CVE-2026-102322 CVE-2026-103621 CVE-2026-103622 CVE-2026-103623                      CVE-2026-103624 CVE-2026-103625 CVE-2026-103626 CVE-2026-103627                      CVE-2026-103628 CVE-2026-103629 CVE-2026-103630 CVE-2026-103631                      CVE-2026-106179 CVE-2026-106180 CVE-2026-106181 CVE-2026-106182                      CVE-2026-106183 CVE-2026-106184 CVE-2026-106185 CVE-2026-106186                      CVE-2026-106187 CVE-2026-106188 CVE-2026-106189 CVE-2026-106190                      CVE-2026-106191 CVE-2026-106192 CVE-2026-106193 CVE-2026-106194                      CVE-2026-106195 CVE-2026-106196 CVE-2026-106197 CVE-2026-106198                      CVE-2026-106199 CVE-2026-106200 CVE-2026-106201 CVE-2026-106202                      CVE-2026-106203 CVE-2026-106204 CVE-2026-106205 CVE-2026-106206                      CVE-2026-106207 CVE-2026-106208 CVE-2026-106209 CVE-2026-106210                      CVE-2026-106211 CVE-2026-106212 CVE-2026-106213 CVE-2026-106214                      CVE-2026-106215 CVE-2026-106216 CVE-2026-106217 CVE-2026-106220                      CVE-2026-106221 CVE-2026-106222 CVE-2026-106223 CVE-2026-106224                      CVE-2026-106225 CVE-2026-106226 CVE-2026-106227 CVE-2026-106228                      CVE-2026-106229 CVE-2026-106230 CVE-2026-106231 CVE-2026-106232                      CVE-2026-106233 CVE-2026-106234 CVE-2026-106235 CVE-2026-106236                      CVE-2026-106237 CVE-2026-106238 CVE-2026-106239 CVE-2026-106240                      CVE-2026-106241 CVE-2026-106242 CVE-2026-106243 CVE-2026-106244                      CVE-2026-106245 CVE-2026-106246 CVE-2026-106247 CVE-2026-106248                      CVE-2026-106249 CVE-2026-106250 CVE-2026-106251 CVE-2026-106252                      CVE-2026-106253 CVE-2026-106254 CVE-2026-106255 CVE-2026-106256                      CVE-2026-106257 CVE-2026-106258 CVE-2026-106259 CVE-2026-106260                      CVE-2026-106261 CVE-2026-106262 CVE-2026-106263 CVE-2026-106264                      CVE-2026-106265 CVE-2026-106266 CVE-2026-106267 CVE-2026-106268                      CVE-2026-106269 CVE-2026-106270 CVE-2026-106271 CVE-2026-106272                      CVE-2026-106273 CVE-2026-106274 CVE-2026-106275 CVE-2026-106276                      CVE-2026-106277 CVE-2026-106278 CVE-2026-106279 CVE-2026-106280                      CVE-2026-106281 CVE-2026-106282 CVE-2026-106283 CVE-2026-106284                      CVE-2026-106285 CVE-2026-106286 CVE-2026-106287 CVE-2026-106288                      CVE-2026-106289 CVE-2026-106290 CVE-2026-106291 CVE-2026-106292                      CVE-2026-106293 CVE-2026-106294 CVE-2026-106295 CVE-2026-106296                      CVE-2026-106297 CVE-2026-106298 CVE-2026-106299 CVE-2026-106300                      CVE-2026-106301 CVE-2026-106302 CVE-2026-106303 CVE-2026-106304                      CVE-2026-106305 CVE-2026-106306 CVE-2026-106307 CVE-2026-106308                      CVE-2026-106309 CVE-2026-106310 CVE-2026-106311 CVE-2026-106312                      CVE-2026-106313 CVE-2026-106314 CVE-2026-106315 CVE-2026-106316                      CVE-2026-106317 CVE-2026-106318 CVE-2026-106320 CVE-2026-106321                      CVE-2026-106322 CVE-2026-106323 CVE-2026-106324 CVE-2026-106325                      CVE-2026-106326 CVE-2026-106327 CVE-2026-106328 CVE-2026-106329                      CVE-2026-106330 CVE-2026-106331 CVE-2026-106332 CVE-2026-106333                      CVE-2026-106334 CVE-2026-106335 CVE-2026-106336 CVE-2026-106337                      CVE-2026-106338 CVE-2026-106339 CVE-2026-106340 CVE-2026-106341                      CVE-2026-106342 CVE-2026-106343 CVE-2026-106344 CVE-2026-106345                      CVE-2026-106346 CVE-2026-106347 CVE-2026-106348 CVE-2026-106349                      CVE-2026-106350 CVE-2026-106351 CVE-2026-106352 CVE-2026-106353                      CVE-2026-106354 CVE-2026-106355 CVE-2026-106356 CVE-2026-106357                      CVE-2026-106358 CVE-2026-106359 CVE-2026-106360 CVE-2026-106361                      CVE-2026-106362 CVE-2026-106363 CVE-2026-106364 CVE-2026-106365                      CVE-2026-106366 CVE-2026-106367 CVE-2026-106368 CVE-2026-106369                      CVE-2026-106370 CVE-2026-106371 CVE-2026-106372 CVE-2026-106373                      CVE-2026-106374 CVE-2026-106375 CVE-2026-106376 CVE-2026-106377                      CVE-2026-106378 CVE-2026-106379 CVE-2026-106380 CVE-2026-106381                      CVE-2026-106382 CVE-2026-106383 CVE-2026-106384 CVE-2026-106385                      CVE-2026-106386 CVE-2026-106387 CVE-2026-106388 CVE-2026-106389                      CVE-2026-106390 CVE-2026-106391 CVE-2026-106392 CVE-2026-106393                      CVE-2026-106394 CVE-2026-106395 CVE-2026-106396 CVE-2026-106397                      CVE-2026-106398 CVE-2026-106399 CVE-2026-106400 CVE-2026-106401                      CVE-2026-106402 CVE-2026-106403 CVE-2026-106404 CVE-2026-106405                      CVE-2026-106406 CVE-2026-106407 CVE-2026-106408 CVE-2026-106409                      CVE-2026-106410 CVE-2026-106411 CVE-2026-106412 CVE-2026-106413                      CVE-2026-106414 CVE-2026-106415 CVE-2026-106416 CVE-2026-106417                      CVE-2026-106418 CVE-2026-106419 CVE-2026-106420 CVE-2026-106421                      CVE-2026-106422 CVE-2026-106423 CVE-2026-106424 CVE-2026-106425                      CVE-2026-106426 CVE-2026-106427

    Security issues were discovered in Chromium which could result     in the execution of arbitrary code, denial of service, or information     disclosure.

    For Debian 12 bookworm, these problems have been fixed in version     155.0.8059.39-1~deb12u1.

    We recommend that you upgrade your chromium packages.

    For the detailed security status of chromium please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/chromium

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22023-1 advisory.

    Changes in chromium:

    - Chromium 154.0.8037.97 (boo#1284015)
      * CVE-2026-103628: Out of bounds write in WebGL
      * CVE-2026-103626: Incorrect authorization in FileSystem
      * CVE-2026-103621: Integer overflow in Compositing
      * CVE-2026-103630: Use after free in FedCM
      * CVE-2026-103625: Type confusion in V8
      * CVE-2026-103624: Use after free in Contextual Tasks
      * CVE-2026-103629: Integer overflow in Skia
      * CVE-2026-103622: Use after free in SVG
      * CVE-2026-103623: Use after free in MediaStream
      * CVE-2026-103631: Buffer overflow in WebRTC
      * CVE-2026-103627: Information leak in SVG

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-02902c2fa0 advisory.

    Update to 154.0.8037.97, includes 11 security fixes

      * CVE-2026-103621: Integer overflow in Compositing
      * CVE-2026-103622: Use after free in SVG
      * CVE-2026-103623: Use after free in MediaStream
      * CVE-2026-103624: Use after free in Contextual Tasks
      * CVE-2026-103625: Type confusion in V8
      * CVE-2026-103626: Incorrect authorization in FileSystem
      * CVE-2026-103627: Information leak in SVG
      * CVE-2026-103628: Out of bounds write in WebGL
      * CVE-2026-103629: Integer overflow in Skia
      * CVE-2026-103630: Use after free in FedCM
      * CVE-2026-103631: Buffer overflow in WebRTC


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-bcdfa4c7db advisory.

    Update to 154.0.8037.97, includes 11 security fixes

      * CVE-2026-103621: Integer overflow in Compositing
      * CVE-2026-103622: Use after free in SVG
      * CVE-2026-103623: Use after free in MediaStream
      * CVE-2026-103624: Use after free in Contextual Tasks
      * CVE-2026-103625: Type confusion in V8
      * CVE-2026-103626: Incorrect authorization in FileSystem
      * CVE-2026-103627: Information leak in SVG
      * CVE-2026-103628: Out of bounds write in WebGL
      * CVE-2026-103629: Integer overflow in Skia
      * CVE-2026-103630: Use after free in FedCM
      * CVE-2026-103631: Buffer overflow in WebRTC


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-
    origin data via a crafted HTML page. (Chromium security severity: High) (CVE-2026-103629)

The remote Fedora 45 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-53c8aca50a advisory.

    Update to 154.0.8037.97, includes 11 security fixes

      * CVE-2026-103621: Integer overflow in Compositing
      * CVE-2026-103622: Use after free in SVG
      * CVE-2026-103623: Use after free in MediaStream
      * CVE-2026-103624: Use after free in Contextual Tasks
      * CVE-2026-103625: Type confusion in V8
      * CVE-2026-103626: Incorrect authorization in FileSystem
      * CVE-2026-103627: Information leak in SVG
      * CVE-2026-103628: Out of bounds write in WebGL
      * CVE-2026-103629: Integer overflow in Skia
      * CVE-2026-103630: Use after free in FedCM
      * CVE-2026-103631: Buffer overflow in WebRTC


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Integer overflow in Skia in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak cross-     origin data via a crafted HTML page. (Chromium security severity: High) (CVE-2026-103629)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Google Chrome installed on the remote macOS host is prior to 154.0.8037.97. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026_10_stable-channel-update-for-desktop advisory.

  - Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute     arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-103630)

  - Integer overflow in Compositing in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak     cross-origin data via a crafted HTML page. (Chromium security severity: High) (CVE-2026-103621)

  - Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute     arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-103622)

  - Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute     arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-103623)

  - Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote     attacker who had compromised the renderer process to potentially execute arbitrary code outside the     sandbox via a crafted HTML page. (Chromium security severity: High) (CVE-2026-103624)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 154.0.8037.97. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026_10_stable-channel-update-for-desktop advisory.

  - Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute     arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-103630)

  - Integer overflow in Compositing in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to leak     cross-origin data via a crafted HTML page. (Chromium security severity: High) (CVE-2026-103621)

  - Use after free in SVG in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute     arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-103622)

  - Use after free in MediaStream in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute     arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-103623)

  - Use after free in Contextual Tasks in Google Chrome on on Windows prior to 154.0.8037.97 allowed a remote     attacker who had compromised the renderer process to potentially execute arbitrary code outside the     sandbox via a crafted HTML page. (Chromium security severity: High) (CVE-2026-103624)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
368070	Debian dsa-6553 : chromium - security update	Nessus	Debian Local Security Checks	Local	critical
365335	Debian dla-4833 : chromium - security update	Nessus	Debian Local Security Checks	Local	critical
364111	openSUSE 16 Security Update : chromium (openSUSE-SU-2026:22023-1)	Nessus	SuSE Local Security Checks	Local	critical
364107	Fedora 43 : chromium (2026-02902c2fa0)	Nessus	Fedora Local Security Checks	Local	critical
364100	Fedora 44 : chromium (2026-bcdfa4c7db)	Nessus	Fedora Local Security Checks	Local	critical
473590	Chainguard: multiple chromium packages: security update to 154.0.8037.97-r0	Tenable Cloud Security	Chainguard Local Security Checks	Local	medium
473590	Chainguard: multiple chromium packages: security update to 154.0.8037.97-r0	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	medium
473251	Echo: chromium: security update to 154.0.8037.92-1~deb13u1+e2	Tenable Cloud Security	Echo Local Security Checks	Local	medium
473251	Echo: chromium: security update to 154.0.8037.92-1~deb13u1+e2	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
363369	Fedora 45 : chromium (2026-53c8aca50a)	Nessus	Fedora Local Security Checks	Local	critical
362848	Linux Distros Unpatched Vulnerability : CVE-2026-103629	Nessus	Misc.	Local	medium
362704	Google Chrome < 154.0.8037.97 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Local	critical
362703	Google Chrome < 154.0.8037.97 Multiple Vulnerabilities	Nessus	Windows	Local	critical

Detections

Analytics

CVE-2026-103629

medium

Tenable Plugins

critical

critical

critical

critical

critical

medium

medium

medium

medium

critical

medium

critical

critical