Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)

The version of Google Chrome installed on the remote Windows host is prior to 149.0.7827.53. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026_06_stable-channel-update-for-desktop advisory.

  - Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute     arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low) (CVE-2026-11303,     CVE-2026-11305, CVE-2026-11306, CVE-2026-11307)

  - Insufficient validation of untrusted input in Enterprise Reporting in Google Chrome prior to 149.0.7827.53     allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape     via a crafted HTML page. (Chromium security severity: Medium) (CVE-2026-11120)

  - Out of bounds read and write in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)     (CVE-2026-10881)

  - Use after free in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute     arbitrary code via a crafted HTML page. (Chromium security severity: Critical) (CVE-2026-10882)

  - Type Confusion in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) (CVE-2026-10883)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 149.0.7827.53. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026_06_stable-channel-update-for-desktop advisory.

  - Use after free in PDFium in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute     arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low) (CVE-2026-11303,     CVE-2026-11305, CVE-2026-11306, CVE-2026-11307)

  - Insufficient validation of untrusted input in Enterprise Reporting in Google Chrome prior to 149.0.7827.53     allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape     via a crafted HTML page. (Chromium security severity: Medium) (CVE-2026-11120)

  - Out of bounds read and write in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to     potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)     (CVE-2026-10881)

  - Use after free in Network in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to execute     arbitrary code via a crafted HTML page. (Chromium security severity: Critical) (CVE-2026-10882)

  - Type Confusion in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) (CVE-2026-10883)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Insufficient validation of untrusted input in ANGLE in Google Chrome prior to 149.0.7827.53 allowed a     remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security     severity: Medium) (CVE-2026-11066)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
319297	Google Chrome < 149.0.7827.53 Multiple Vulnerabilities	Nessus	Windows	critical
319296	Google Chrome < 149.0.7827.53 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
319194	Linux Distros Unpatched Vulnerability : CVE-2026-11066	Nessus	Misc.	critical

Detections

Analytics

CVE-2026-11066

critical

Tenable Plugins

critical

critical

critical