Use after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

The version of Microsoft Edge installed on the remote Windows host is prior to 156.0.4314.42. It is, therefore, affected by multiple vulnerabilities as referenced in the October 26, 2026 advisory.

  - Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker     to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security     severity: Medium) (CVE-2026-113016, CVE-2026-113231, CVE-2026-113264)

  - Type confusion in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute     arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-102299, CVE-2026-102321, CVE-2026-102323, CVE-2026-102326, CVE-2026-102328)

  - Out of bounds write in GPU in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had     compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted     HTML page. (Chromium security severity: High) (CVE-2026-102301)

  - Buffer overflow in V8 in Google Chrome prior to 154.0.8037.92 allowed a remote attacker to execute     arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-102302)

  - Uninitialized resource in GPU in Google Chrome on on Android prior to 154.0.8037.92 allowed a remote     attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-102303)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6553 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6553-1                   security@debian.org     https://www.debian.org/security/                           Andres Salomon     October 12, 2026                      https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : chromium     CVE ID         : CVE-2026-102322 CVE-2026-103621 CVE-2026-103622 CVE-2026-103623                      CVE-2026-103624 CVE-2026-103625 CVE-2026-103626 CVE-2026-103627                      CVE-2026-103628 CVE-2026-103629 CVE-2026-103630 CVE-2026-103631                      CVE-2026-106179 CVE-2026-106180 CVE-2026-106181 CVE-2026-106182                      CVE-2026-106183 CVE-2026-106184 CVE-2026-106185 CVE-2026-106186                      CVE-2026-106187 CVE-2026-106188 CVE-2026-106189 CVE-2026-106190                      CVE-2026-106191 CVE-2026-106192 CVE-2026-106193 CVE-2026-106194                      CVE-2026-106195 CVE-2026-106196 CVE-2026-106197 CVE-2026-106198                      CVE-2026-106199 CVE-2026-106200 CVE-2026-106201 CVE-2026-106202                      CVE-2026-106203 CVE-2026-106204 CVE-2026-106205 CVE-2026-106206                      CVE-2026-106207 CVE-2026-106208 CVE-2026-106209 CVE-2026-106210                      CVE-2026-106211 CVE-2026-106212 CVE-2026-106213 CVE-2026-106214                      CVE-2026-106215 CVE-2026-106216 CVE-2026-106217 CVE-2026-106220                      CVE-2026-106221 CVE-2026-106222 CVE-2026-106223 CVE-2026-106224                      CVE-2026-106225 CVE-2026-106226 CVE-2026-106227 CVE-2026-106228                      CVE-2026-106229 CVE-2026-106230 CVE-2026-106231 CVE-2026-106232                      CVE-2026-106233 CVE-2026-106234 CVE-2026-106235 CVE-2026-106236                      CVE-2026-106237 CVE-2026-106238 CVE-2026-106239 CVE-2026-106240                      CVE-2026-106241 CVE-2026-106242 CVE-2026-106243 CVE-2026-106244                      CVE-2026-106245 CVE-2026-106246 CVE-2026-106247 CVE-2026-106248                      CVE-2026-106249 CVE-2026-106250 CVE-2026-106251 CVE-2026-106252                      CVE-2026-106253 CVE-2026-106254 CVE-2026-106255 CVE-2026-106256                      CVE-2026-106257 CVE-2026-106258 CVE-2026-106259 CVE-2026-106260                      CVE-2026-106261 CVE-2026-106262 CVE-2026-106263 CVE-2026-106264                      CVE-2026-106265 CVE-2026-106266 CVE-2026-106267 CVE-2026-106268                      CVE-2026-106269 CVE-2026-106270 CVE-2026-106271 CVE-2026-106272                      CVE-2026-106273 CVE-2026-106274 CVE-2026-106275 CVE-2026-106276                      CVE-2026-106277 CVE-2026-106278 CVE-2026-106279 CVE-2026-106280                      CVE-2026-106281 CVE-2026-106282 CVE-2026-106283 CVE-2026-106284                      CVE-2026-106285 CVE-2026-106286 CVE-2026-106287 CVE-2026-106288                      CVE-2026-106289 CVE-2026-106290 CVE-2026-106291 CVE-2026-106292                      CVE-2026-106293 CVE-2026-106294 CVE-2026-106295 CVE-2026-106296                      CVE-2026-106297 CVE-2026-106298 CVE-2026-106299 CVE-2026-106300                      CVE-2026-106301 CVE-2026-106302 CVE-2026-106303 CVE-2026-106304                      CVE-2026-106305 CVE-2026-106306 CVE-2026-106307 CVE-2026-106308                      CVE-2026-106309 CVE-2026-106310 CVE-2026-106311 CVE-2026-106312                      CVE-2026-106313 CVE-2026-106314 CVE-2026-106315 CVE-2026-106316                      CVE-2026-106317 CVE-2026-106318 CVE-2026-106320 CVE-2026-106321                      CVE-2026-106322 CVE-2026-106323 CVE-2026-106324 CVE-2026-106325                      CVE-2026-106326 CVE-2026-106327 CVE-2026-106328 CVE-2026-106329                      CVE-2026-106330 CVE-2026-106331 CVE-2026-106332 CVE-2026-106333                      CVE-2026-106334 CVE-2026-106335 CVE-2026-106336 CVE-2026-106337                      CVE-2026-106338 CVE-2026-106339 CVE-2026-106340 CVE-2026-106341                      CVE-2026-106342 CVE-2026-106343 CVE-2026-106344 CVE-2026-106345                      CVE-2026-106346 CVE-2026-106347 CVE-2026-106348 CVE-2026-106349                      CVE-2026-106350 CVE-2026-106351 CVE-2026-106352 CVE-2026-106353                      CVE-2026-106354 CVE-2026-106355 CVE-2026-106356 CVE-2026-106357                      CVE-2026-106358 CVE-2026-106359 CVE-2026-106360 CVE-2026-106361                      CVE-2026-106362 CVE-2026-106363 CVE-2026-106364 CVE-2026-106365                      CVE-2026-106366 CVE-2026-106367 CVE-2026-106368 CVE-2026-106369                      CVE-2026-106370 CVE-2026-106371 CVE-2026-106372 CVE-2026-106373                      CVE-2026-106374 CVE-2026-106375 CVE-2026-106376 CVE-2026-106377                      CVE-2026-106378 CVE-2026-106379 CVE-2026-106380 CVE-2026-106381                      CVE-2026-106382 CVE-2026-106383 CVE-2026-106384 CVE-2026-106385                      CVE-2026-106386 CVE-2026-106387 CVE-2026-106388 CVE-2026-106389                      CVE-2026-106390 CVE-2026-106391 CVE-2026-106392 CVE-2026-106393                      CVE-2026-106394 CVE-2026-106395 CVE-2026-106396 CVE-2026-106397                      CVE-2026-106398 CVE-2026-106399 CVE-2026-106400 CVE-2026-106401                      CVE-2026-106402 CVE-2026-106403 CVE-2026-106404 CVE-2026-106405                      CVE-2026-106406 CVE-2026-106407 CVE-2026-106408 CVE-2026-106409                      CVE-2026-106410 CVE-2026-106411 CVE-2026-106412 CVE-2026-106413                      CVE-2026-106414 CVE-2026-106415 CVE-2026-106416 CVE-2026-106417                      CVE-2026-106418 CVE-2026-106419 CVE-2026-106420 CVE-2026-106421                      CVE-2026-106422 CVE-2026-106423 CVE-2026-106424 CVE-2026-106425                      CVE-2026-106426 CVE-2026-106427

    Security issues were discovered in Chromium which could result     in the execution of arbitrary code, denial of service, or information     disclosure.

    For the stable distribution (trixie), these problems have been fixed in     version 155.0.8059.39-1~deb13u1.

    We recommend that you upgrade your chromium packages.

    For the detailed security status of chromium please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/chromium

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22041-1 advisory.

    Changes in chromium:

    - Chromium 155 promoted to stable - 155.0.8059.39 (boo#1284354):
      * CVE-2026-106382: Use after free in Chromecast
      * CVE-2026-106197: Use after free in Browser
      * CVE-2026-106358: Use after free in Navigation
      * CVE-2026-106347: Use after free in Track
      * CVE-2026-106245: Uninitialized resource in ANGLE
      * CVE-2026-106327: Incorrect authorization in Core
      * CVE-2026-106366: Incomplete cleanup in CustomTabs
      * CVE-2026-106258: Uninitialized resource in ANGLE
      * CVE-2026-106376: Uninitialized resource in ANGLE
      * CVE-2026-106308: Incorrect reference resolution in Autofill
      * CVE-2026-106215: Uninitialized resource in ANGLE
      * CVE-2026-106369: Missing authorization in Translate
      * CVE-2026-106293: Type confusion in ANGLE
      * CVE-2026-106377: Race condition in Fonts
      * CVE-2026-106412: Race condition in Core
      * CVE-2026-106243: Incomplete cleanup in Proxy Auth
      * CVE-2026-106214: Information leak in Proxy
      * CVE-2026-106364: Incorrect authorization in Omnibox
      * CVE-2026-106239: Integer overflow in WebGL
      * CVE-2026-106426: Race condition in Fonts
      * CVE-2026-106419: Use after free in ANGLE
      * CVE-2026-106396: Improper input validation in Omnibox
      * CVE-2026-106323: Missing authorization in Chrome for iOS
      * CVE-2026-106231: Uninitialized resource in Dawn
      * CVE-2026-106202: Uninitialized resource in ANGLE
      * CVE-2026-106273: Uninitialized resource in Video
      * CVE-2026-106203: Incomplete cleanup in Autofill
      * CVE-2026-106332: Integer overflow in Compositing
      * CVE-2026-106281: Use after free in Tint
      * CVE-2026-106298: Use after free in Chrome Tabs
      * CVE-2026-106193: Use after free in Parser
      * CVE-2026-106255: Race condition in V8
      * CVE-2026-106393: Use after free in Storage
      * CVE-2026-106227: Use after free in Core
      * CVE-2026-106379: Uninitialized resource in Skia
      * CVE-2026-106211: Use after free in TabStrip
      * CVE-2026-106329: Incorrect authorization in FileSystem
      * CVE-2026-106248: Use after free in Bindings
      * CVE-2026-106235: Use after free in WebAudio
      * CVE-2026-106257: Use after free in HTML
      * CVE-2026-106268: Use after free in WebRTC
      * CVE-2026-106278: Use after free in Select
      * CVE-2026-106233: Use after free in Metrics
      * CVE-2026-106318: Use after free in Media
      * CVE-2026-106411: Use after free in Parser
      * CVE-2026-106423: Use after free in Media
      * CVE-2026-106346: Improper state validation in DevTools
      * CVE-2026-106190: Use after free in Media
      * CVE-2026-106357: Use after free in WebRTC
      * CVE-2026-106240: Type confusion in V8
      * CVE-2026-106184: Uninitialized resource in Media
      * CVE-2026-106383: Use after free in Media
      * CVE-2026-106349: Use after free in V8
      * CVE-2026-106421: Use after free in PDF
      * CVE-2026-106204: Use after free in PDF
      * CVE-2026-106200: Use after free in Track
      * CVE-2026-106265: UI misrepresentation in File
      * CVE-2026-106238: Race condition in Fonts
      * CVE-2026-106324: Incorrect authorization in WebAppInstalls
      * CVE-2026-106420: Incorrect calculation in API
      * CVE-2026-106222: Incorrect authorization in Sync
      * CVE-2026-106208: Missing authorization in API
      * CVE-2026-106286: Confused deputy in Omnibox
      * CVE-2026-106181: Incorrect reference resolution in DevTools
      * CVE-2026-106315: Use after free in Modularization
      * CVE-2026-106274: Incorrect reference resolution in Browser
      * CVE-2026-106365: Missing authorization in Animation
      * CVE-2026-106267: Missing authorization in Network
      * CVE-2026-106194: Missing authorization in WebAppInstalls
      * CVE-2026-106313: Incorrect authorization in Browser
      * CVE-2026-106283: Use after free in Streaming
      * CVE-2026-106291: Use after free in GarbageCollection
      * CVE-2026-106300: Race condition in CacheStorage
      * CVE-2026-106314: Incorrect authorization in Bluetooth
      * CVE-2026-106223: Uninitialized resource in GPU
      * CVE-2026-106242: Information leak in Omnibox
      * CVE-2026-106241: Incorrect authorization in Search
      * CVE-2026-106381: Incorrect authorization in Passwords
      * CVE-2026-106217: Missing authorization in Google Lens
      * CVE-2026-106425: Missing authorization in BrowserTag
      * CVE-2026-106225: Missing authorization in Autofill
      * CVE-2026-106363: Missing authorization in FullScreen
      * CVE-2026-106266: Confused deputy in Contextual Tasks
      * CVE-2026-106189: Code injection in ReaderMode
      * CVE-2026-106335: Use after free in Media
      * CVE-2026-106415: Information leak in Enterprise
      * CVE-2026-106224: Missing authorization in Google Lens
      * CVE-2026-106185: Improper input validation in Viz
      * CVE-2026-106244: Incorrect authorization in Permissions
      * CVE-2026-106407: Incorrect authorization in GetUserMedia
      * CVE-2026-106389: Incorrect authorization in USB
      * CVE-2026-106397: Incorrect authorization in Mobile
      * CVE-2026-106196: Missing authorization in Navigation
      * CVE-2026-106414: Improper input validation in Mobile
      * CVE-2026-106408: Protection mechanism failure in Mobile
      * CVE-2026-106261: Uninitialized resource in Video
      * CVE-2026-106406: Missing authorization in Mobile
      * CVE-2026-106290: Uninitialized resource in GPU
      * CVE-2026-106378: Privilege elevation in Sandbox
      * CVE-2026-106198: Missing authorization in FileSystem
      * CVE-2026-106326: Confused deputy in UI
      * CVE-2026-106354: Improper resource exposure in Extensions
      * CVE-2026-106342: Information leak in Autofill
      * CVE-2026-106424: Information leak in Audio
      * CVE-2026-106253: Incorrect authorization in Extensions
      * CVE-2026-106279: Incorrect reference resolution in Passwords
      * CVE-2026-106361: Incorrect provision of specified functionality in Mobile
      * CVE-2026-106402: Incorrect authorization in Extensions
      * CVE-2026-106311: Clickjacking in PermissionElement
      * CVE-2026-106246: Incorrect authorization in Browser
      * CVE-2026-106302: UI misrepresentation in PermissionElement
      * CVE-2026-106416: Code injection in Extensions
      * CVE-2026-106182: UI misrepresentation in Paint
      * CVE-2026-106282: UI misrepresentation in WebOTP
      * CVE-2026-106392: Information leak in WebAudio
      * CVE-2026-106188: Confused deputy in SignIn
      * CVE-2026-106370: Uninitialized resource in GPU
      * CVE-2026-106356: Clickjacking in EVP
      * CVE-2026-106405: Race condition in CustomTabs
      * CVE-2026-106322: Open redirect in AppManifest
      * CVE-2026-106280: Incorrect authorization in PermissionElement
      * CVE-2026-106206: Improper input validation in Mobile
      * CVE-2026-106180: Observable discrepancy in Animation
      * CVE-2026-106303: Observable discrepancy in Autofill AI
      * CVE-2026-106201: Race condition in V8
      * CVE-2026-106333: Incorrect authorization in Input
      * CVE-2026-106228: Confused deputy in Google Lens
      * CVE-2026-106289: Missing authorization in FedCM
      * CVE-2026-106277: Information leak in Animation
      * CVE-2026-106410: Missing authorization in Permissions
      * CVE-2026-106284: Out of bounds read in Printing
      * CVE-2026-106209: UI misrepresentation in Mobile
      * CVE-2026-106216: Cross-site request forgery in ReadingList
      * CVE-2026-106328: Incorrect authorization in PDF
      * CVE-2026-106387: Missing authorization in Mobile
      * CVE-2026-106400: Clickjacking in Messages
      * CVE-2026-106205: Missing authorization in Passwords
      * CVE-2026-106213: Race condition in WebAudio
      * CVE-2026-106230: Incorrect reference resolution in Offline
      * CVE-2026-106367: Missing authorization in Mobile
      * CVE-2026-106226: Improper input validation in Compositing
      * CVE-2026-106229: UI misrepresentation in FileSystem
      * CVE-2026-106232: UI misrepresentation in Browser
      * CVE-2026-106391: Incorrect authorization in WebShare
      * CVE-2026-106336: Observable discrepancy in Paint
      * CVE-2026-106403: Incorrect authorization in Accessibility
      * CVE-2026-106373: Use after free in Fonts
      * CVE-2026-106301: Confused deputy in Contextual Tasks
      * CVE-2026-106292: Buffer overflow in Fonts
      * CVE-2026-106262: Incomplete cleanup in GetUserMedia
      * CVE-2026-106360: Information leak in Payments
      * CVE-2026-106375: Incomplete cleanup in Dawn
      * CVE-2026-106348: Information leak in Animation
      * CVE-2026-106307: Incorrect authorization in Network
      * CVE-2026-106212: Incorrect authorization in Autofill
      * CVE-2026-106398: Incorrect authorization in Media
      * CVE-2026-106388: Missing authorization in DataTransfer
      * CVE-2026-106271: Missing authorization in Workers
      * CVE-2026-106395: Uninitialized resource in Dawn
      * CVE-2026-106304: Out of bounds read in ANGLE
      * CVE-2026-106401: Out of bounds write in Media
      * CVE-2026-106330: Information leak in Paint
      * CVE-2026-106295: Incorrect authorization in Unbounded Element
      * CVE-2026-106352: Incorrect authorization in WebProtect
      * CVE-2026-106337: UI misrepresentation in UI
      * CVE-2026-106263: Improper input validation in SignIn
      * CVE-2026-106404: Incorrect authorization in FontAccess
      * CVE-2026-106183: Missing authorization in Chromoting
      * CVE-2026-106386: Uninitialized resource in WebAudio
      * CVE-2026-106351: Observable discrepancy in Safebrowsing
      * CVE-2026-106384: Missing authorization in SiteIsolation
      * CVE-2026-106207: Race condition in V8
      * CVE-2026-106321: Information leak in Editing
      * CVE-2026-106210: Observable discrepancy in Scroll
      * CVE-2026-106254: Information leak in Mobile
      * CVE-2026-106372: Incorrect authorization in UI
      * CVE-2026-106341: Type confusion in V8
      * CVE-2026-106409: Incorrect reference resolution in WebAppInstalls
      * CVE-2026-106340: Missing authorization in CredentialProvider
      * CVE-2026-106276: UI misrepresentation in Payments
      * CVE-2026-106338: UI misrepresentation in PictureInPicture
      * CVE-2026-106317: UI misrepresentation in FullScreen
      * CVE-2026-106344: Missing authorization in Permissions
      * CVE-2026-106359: Confused deputy in DeviceBoundSessionCredentials
      * CVE-2026-106353: Improper input validation in Mobile
      * CVE-2026-106312: Missing authorization in SignIn
      * CVE-2026-106191: Missing authorization in Actor
      * CVE-2026-106250: Missing authorization in Actor
      * CVE-2026-106309: Incorrect authorization in Selection
      * CVE-2026-106187: Missing authorization in Permissions
      * CVE-2026-106394: Incomplete cleanup in Glic
      * CVE-2026-106306: Incorrect authorization in DevTools
      * CVE-2026-106427: Confused deputy in Mobile
      * CVE-2026-106252: Incorrect comparison in Fonts
      * CVE-2026-106287: Information loss in CORS
      * CVE-2026-106297: Incorrect authorization in Scheduling
      * CVE-2026-106260: Incorrect authorization in DevTools
      * CVE-2026-106362: Missing authorization in DevTools
      * CVE-2026-106275: Uninitialized resource in GPU
      * CVE-2026-106199: Incorrect authorization in Actor
      * CVE-2026-106299: Improper input validation in WebAudio
      * CVE-2026-106422: Incorrect authorization in API
      * CVE-2026-106186: Uncontrolled search path element in CredentialProvider
      * CVE-2026-106247: Buffer overflow in ANGLE
      * CVE-2026-106192: Information leak in Mobile
      * CVE-2026-106399: Out of bounds read in Skia
      * CVE-2026-106264: Missing authorization in Web Authentication (Passkeys & Security Keys)
      * CVE-2026-106285: UI misrepresentation in WebAppInstalls
      * CVE-2026-106220: Information leak in Passwords
      * CVE-2026-106417: Integer overflow in Media
      * CVE-2026-106221: Confused deputy in WebAPKs
      * CVE-2026-106259: Incorrect authorization in PermissionElement
      * CVE-2026-106296: Improper privilege management in UI
      * CVE-2026-106249: Incorrect authorization in Autofill
      * CVE-2026-106374: Type confusion in V8
      * CVE-2026-106380: UI misrepresentation in UI
      * CVE-2026-106179: UI misrepresentation in WebAppInstalls
      * CVE-2026-106368: UI misrepresentation in UI
      * CVE-2026-106237: Information leak in Permissions
      * CVE-2026-106331: Improper input validation in Extensions
      * CVE-2026-106270: Incorrect authorization in WebAppInstalls
      * CVE-2026-106350: Incorrect authorization in Browser
      * CVE-2026-106288: Missing authorization in Browser
      * CVE-2026-106305: UI misrepresentation in Mobile
      * CVE-2026-106418: Missing authorization in Network
      * CVE-2026-106343: Improper state validation in Autofill AI
      * CVE-2026-106371: Incorrect authorization in Transactions Platform
      * CVE-2026-106256: Information leak in Passwords
      * CVE-2026-106413: Race condition in Browser
      * CVE-2026-106339: Use of released resource in Core
      * CVE-2026-106320: Use of released resource in UI
      * CVE-2026-106195: Incorrect authorization in Chromoting
      * CVE-2026-106316: UI misrepresentation in Chromoting
      * CVE-2026-106385: Race condition in Chromoting
      * CVE-2026-106325: Incorrect reference resolution in Core
      * CVE-2026-106390: Incorrect provision of specified functionality in SanitizerAPI
      * CVE-2026-106294: Incomplete cleanup in Chromoting
      * CVE-2026-106334: Information leak in Payments
      * CVE-2026-106236: UI misrepresentation in Chromoting
      * CVE-2026-106251: UI misrepresentation in Chromoting
      * CVE-2026-106310: Use of released resource in FontAccess
      * CVE-2026-106345: Use of released resource in Session
      * CVE-2026-106272: UI misrepresentation in Chromoting
      * CVE-2026-106355: Missing authorization in Media
      * CVE-2026-106234: Use after free in Network
      * CVE-2026-106269: Use after free in CSS

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Use after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to
    execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)
    (CVE-2026-106419)

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4833 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4833-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     October 13, 2026                              https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : chromium     Version        : 155.0.8059.39-1~deb12u1     CVE ID         : CVE-2026-102322 CVE-2026-103621 CVE-2026-103622 CVE-2026-103623                      CVE-2026-103624 CVE-2026-103625 CVE-2026-103626 CVE-2026-103627                      CVE-2026-103628 CVE-2026-103629 CVE-2026-103630 CVE-2026-103631                      CVE-2026-106179 CVE-2026-106180 CVE-2026-106181 CVE-2026-106182                      CVE-2026-106183 CVE-2026-106184 CVE-2026-106185 CVE-2026-106186                      CVE-2026-106187 CVE-2026-106188 CVE-2026-106189 CVE-2026-106190                      CVE-2026-106191 CVE-2026-106192 CVE-2026-106193 CVE-2026-106194                      CVE-2026-106195 CVE-2026-106196 CVE-2026-106197 CVE-2026-106198                      CVE-2026-106199 CVE-2026-106200 CVE-2026-106201 CVE-2026-106202                      CVE-2026-106203 CVE-2026-106204 CVE-2026-106205 CVE-2026-106206                      CVE-2026-106207 CVE-2026-106208 CVE-2026-106209 CVE-2026-106210                      CVE-2026-106211 CVE-2026-106212 CVE-2026-106213 CVE-2026-106214                      CVE-2026-106215 CVE-2026-106216 CVE-2026-106217 CVE-2026-106220                      CVE-2026-106221 CVE-2026-106222 CVE-2026-106223 CVE-2026-106224                      CVE-2026-106225 CVE-2026-106226 CVE-2026-106227 CVE-2026-106228                      CVE-2026-106229 CVE-2026-106230 CVE-2026-106231 CVE-2026-106232                      CVE-2026-106233 CVE-2026-106234 CVE-2026-106235 CVE-2026-106236                      CVE-2026-106237 CVE-2026-106238 CVE-2026-106239 CVE-2026-106240                      CVE-2026-106241 CVE-2026-106242 CVE-2026-106243 CVE-2026-106244                      CVE-2026-106245 CVE-2026-106246 CVE-2026-106247 CVE-2026-106248                      CVE-2026-106249 CVE-2026-106250 CVE-2026-106251 CVE-2026-106252                      CVE-2026-106253 CVE-2026-106254 CVE-2026-106255 CVE-2026-106256                      CVE-2026-106257 CVE-2026-106258 CVE-2026-106259 CVE-2026-106260                      CVE-2026-106261 CVE-2026-106262 CVE-2026-106263 CVE-2026-106264                      CVE-2026-106265 CVE-2026-106266 CVE-2026-106267 CVE-2026-106268                      CVE-2026-106269 CVE-2026-106270 CVE-2026-106271 CVE-2026-106272                      CVE-2026-106273 CVE-2026-106274 CVE-2026-106275 CVE-2026-106276                      CVE-2026-106277 CVE-2026-106278 CVE-2026-106279 CVE-2026-106280                      CVE-2026-106281 CVE-2026-106282 CVE-2026-106283 CVE-2026-106284                      CVE-2026-106285 CVE-2026-106286 CVE-2026-106287 CVE-2026-106288                      CVE-2026-106289 CVE-2026-106290 CVE-2026-106291 CVE-2026-106292                      CVE-2026-106293 CVE-2026-106294 CVE-2026-106295 CVE-2026-106296                      CVE-2026-106297 CVE-2026-106298 CVE-2026-106299 CVE-2026-106300                      CVE-2026-106301 CVE-2026-106302 CVE-2026-106303 CVE-2026-106304                      CVE-2026-106305 CVE-2026-106306 CVE-2026-106307 CVE-2026-106308                      CVE-2026-106309 CVE-2026-106310 CVE-2026-106311 CVE-2026-106312                      CVE-2026-106313 CVE-2026-106314 CVE-2026-106315 CVE-2026-106316                      CVE-2026-106317 CVE-2026-106318 CVE-2026-106320 CVE-2026-106321                      CVE-2026-106322 CVE-2026-106323 CVE-2026-106324 CVE-2026-106325                      CVE-2026-106326 CVE-2026-106327 CVE-2026-106328 CVE-2026-106329                      CVE-2026-106330 CVE-2026-106331 CVE-2026-106332 CVE-2026-106333                      CVE-2026-106334 CVE-2026-106335 CVE-2026-106336 CVE-2026-106337                      CVE-2026-106338 CVE-2026-106339 CVE-2026-106340 CVE-2026-106341                      CVE-2026-106342 CVE-2026-106343 CVE-2026-106344 CVE-2026-106345                      CVE-2026-106346 CVE-2026-106347 CVE-2026-106348 CVE-2026-106349                      CVE-2026-106350 CVE-2026-106351 CVE-2026-106352 CVE-2026-106353                      CVE-2026-106354 CVE-2026-106355 CVE-2026-106356 CVE-2026-106357                      CVE-2026-106358 CVE-2026-106359 CVE-2026-106360 CVE-2026-106361                      CVE-2026-106362 CVE-2026-106363 CVE-2026-106364 CVE-2026-106365                      CVE-2026-106366 CVE-2026-106367 CVE-2026-106368 CVE-2026-106369                      CVE-2026-106370 CVE-2026-106371 CVE-2026-106372 CVE-2026-106373                      CVE-2026-106374 CVE-2026-106375 CVE-2026-106376 CVE-2026-106377                      CVE-2026-106378 CVE-2026-106379 CVE-2026-106380 CVE-2026-106381                      CVE-2026-106382 CVE-2026-106383 CVE-2026-106384 CVE-2026-106385                      CVE-2026-106386 CVE-2026-106387 CVE-2026-106388 CVE-2026-106389                      CVE-2026-106390 CVE-2026-106391 CVE-2026-106392 CVE-2026-106393                      CVE-2026-106394 CVE-2026-106395 CVE-2026-106396 CVE-2026-106397                      CVE-2026-106398 CVE-2026-106399 CVE-2026-106400 CVE-2026-106401                      CVE-2026-106402 CVE-2026-106403 CVE-2026-106404 CVE-2026-106405                      CVE-2026-106406 CVE-2026-106407 CVE-2026-106408 CVE-2026-106409                      CVE-2026-106410 CVE-2026-106411 CVE-2026-106412 CVE-2026-106413                      CVE-2026-106414 CVE-2026-106415 CVE-2026-106416 CVE-2026-106417                      CVE-2026-106418 CVE-2026-106419 CVE-2026-106420 CVE-2026-106421                      CVE-2026-106422 CVE-2026-106423 CVE-2026-106424 CVE-2026-106425                      CVE-2026-106426 CVE-2026-106427

    Security issues were discovered in Chromium which could result     in the execution of arbitrary code, denial of service, or information     disclosure.

    For Debian 12 bookworm, these problems have been fixed in version     155.0.8059.39-1~deb12u1.

    We recommend that you upgrade your chromium packages.

    For the detailed security status of chromium please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/chromium

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Use after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to     execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-106419)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Google Chrome installed on the remote macOS host is prior to 155.0.8059.39. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026_10_stable-channel-update-for-desktop_086471744 advisory.

  - Use after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to     execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-106419)

  - Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute     arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-106190, CVE-2026-106318, CVE-2026-106383, CVE-2026-106423)

  - Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker     to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) (CVE-2026-102322)

  - Incorrect reference resolution in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote     attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page.
    (Chromium security severity: Medium) (CVE-2026-106181)

  - Uninitialized resource in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to     obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) (CVE-2026-106184)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 155.0.8059.39. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026_10_stable-channel-update-for-desktop_086471744 advisory.

  - Use after free in ANGLE in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker to     execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-106419)

  - Use after free in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute     arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-106190, CVE-2026-106318, CVE-2026-106383, CVE-2026-106423)

  - Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker     to execute arbitrary code via a crafted HTML page. (Chromium security severity: High) (CVE-2026-102322)

  - Incorrect reference resolution in DevTools in Google Chrome prior to 155.0.8059.39 allowed a remote     attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page.
    (Chromium security severity: Medium) (CVE-2026-106181)

  - Uninitialized resource in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to     obtain cross-origin data via a crafted HTML page. (Chromium security severity: High) (CVE-2026-106184)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
370895	Microsoft Edge (Chromium) < 156.0.4314.42 Multiple Vulnerabilities	Nessus	Windows	Local	high
368070	Debian dsa-6553 : chromium - security update	Nessus	Debian Local Security Checks	Local	critical
367975	openSUSE 16 Security Update : chromium (openSUSE-SU-2026:22041-1)	Nessus	SuSE Local Security Checks	Local	critical
474536	Echo: chromium: security update to 155.0.8059.39	Tenable Cloud Security	Echo Local Security Checks	Local	critical
474536	Echo: chromium: security update to 155.0.8059.39	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical
365335	Debian dla-4833 : chromium - security update	Nessus	Debian Local Security Checks	Local	critical
474266	Chainguard: multiple chromium packages: security update to 155.0.8059.39-r0	Tenable Cloud Security	Chainguard Local Security Checks	Local	critical
474266	Chainguard: multiple chromium packages: security update to 155.0.8059.39-r0	Tenable Self-Hosted Container Security	Chainguard Local Security Checks	Local	critical
363526	Linux Distros Unpatched Vulnerability : CVE-2026-106419	Nessus	Misc.	Local	critical
363365	Google Chrome < 155.0.8059.39 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Local	critical
363364	Google Chrome < 155.0.8059.39 Multiple Vulnerabilities	Nessus	Windows	Local	critical

Detections

Analytics

CVE-2026-106419

critical

Tenable Plugins

high

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical