Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

The version of Microsoft Edge installed on the remote Windows host is prior to 149.0.4022.62. It is, therefore, affected by multiple vulnerabilities as referenced in the June 15, 2026 advisory.

  - Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.103 allowed     a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML     page. (Chromium security severity: High) (CVE-2026-11658)

  - Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a local attacker to potentially     exploit heap corruption via physical access to the device. (Chromium security severity: Critical)     (CVE-2026-11628)

  - Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) (CVE-2026-11629)

  - Use after free in File Input in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)     (CVE-2026-11630)

  - Use after free in Aura in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker who     had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (Chromium security severity: Critical) (CVE-2026-11631)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20944-1 advisory.

    Changes in chromium:

    - Chromium 149.0.7827.102 (boo#1267911):
      * CVE-2026-11628: Use after free in Ozone
      * CVE-2026-11629: Use after free in Ozone
      * CVE-2026-11630: Use after free in File Input
      * CVE-2026-11631: Use after free in Aura
      * CVE-2026-11632: Use after free in TabStrip
      * CVE-2026-11633: Use after free in Bluetooth
      * CVE-2026-11634: Use after free in Gamepad
      * CVE-2026-11635: Use after free in Bluetooth
      * CVE-2026-11636: Use after free in Autofill
      * CVE-2026-11637: Use after free in Views
      * CVE-2026-11638: Use after free in Printing
      * CVE-2026-11639: Use after free in Compositing
      * CVE-2026-11640: Integer overflow in libyuv
      * CVE-2026-11641: Use after free in Bluetooth
      * CVE-2026-11642: Use after free in Web Apps
      * CVE-2026-11643: Use after free in Proxy
      * CVE-2026-11644: Use after free in Views
      * CVE-2026-11645: Out of bounds memory access in V8
      * CVE-2026-11646: Use after free in ViewTransitions
      * CVE-2026-11647: Use after free in Printing
      * CVE-2026-11648: Use after free in FullScreen
      * CVE-2026-11649: Use after free in V8
      * CVE-2026-11650: Use after free in V8
      * CVE-2026-11651: Use after free in Network
      * CVE-2026-11652: Use after free in Extensions
      * CVE-2026-11653: Insufficient validation of untrusted input in Extensions
      * CVE-2026-11654: Use after free in CameraCapture
      * CVE-2026-11655: Integer overflow in Media
      * CVE-2026-11656: Use after free in ServiceWorker
      * CVE-2026-11657: Use after free in Payments
      * CVE-2026-11658: Insufficient validation of untrusted input in Extensions
      * CVE-2026-11659: Insufficient validation of untrusted input in UI
      * CVE-2026-11660: Insufficient validation of untrusted input in New Tab Page
      * CVE-2026-11661: Use after free in Views
      * CVE-2026-11662: Type Confusion in Bindings
      * CVE-2026-11663: Use after free in Skia
      * CVE-2026-11664: Use after free in Payments
      * CVE-2026-11665: Out of bounds read in Dawn
      * CVE-2026-11666: Insufficient validation of untrusted input in Input
      * CVE-2026-11667: Out of bounds read in WebRTC
      * CVE-2026-11668: Uninitialized Use in Codecs
      * CVE-2026-11669: Integer overflow in Media
      * CVE-2026-11670: Use after free in PDF
      * CVE-2026-11671: Use after free in Navigation
      * CVE-2026-11672: Out of bounds write in GPU
      * CVE-2026-11673: Use after free in InterestGroups
      * CVE-2026-11674: Use after free in Guest View
      * CVE-2026-11675: Insufficient validation of untrusted input in Skia
      * CVE-2026-11676: Insufficient validation of untrusted input in Dawn
      * CVE-2026-11677: Race in Network
      * CVE-2026-11678: Integer overflow in libyuv
      * CVE-2026-11679: Use after free in Codecs
      * CVE-2026-11680: Use after free in Media
      * CVE-2026-11681: Use after free in Ozone
      * CVE-2026-11682: Insufficient validation of untrusted input in Views
      * CVE-2026-11683: Use after free in WebCodecs
      * CVE-2026-11684: Insufficient policy enforcement in Network
      * CVE-2026-11685: Insufficient data validation in MediaCapture
      * CVE-2026-11686: Insufficient validation of untrusted input in Dawn
      * CVE-2026-11687: Use after free in Dawn
      * CVE-2026-11688: Object lifecycle issue in SVG
      * CVE-2026-11689: Insufficient validation of untrusted input in Passwords
      * CVE-2026-11690: Out of bounds read and write in Media
      * CVE-2026-11691: Insufficient validation of untrusted input in New Tab Page
      * CVE-2026-11692: Use after free in Read Anything
      * CVE-2026-11693: Inappropriate implementation in Plugins
      * CVE-2026-11694: Use after free in ServiceWorker
      * CVE-2026-11695: Inappropriate implementation in Passwords
      * CVE-2026-11696: Uninitialized Use in Video
      * CVE-2026-11697: Insufficient validation of untrusted input in UI
      * CVE-2026-11698: Use after free in Bluetooth
      * CVE-2026-11699: Use after free in Bluetooth
      * CVE-2026-11700: Use after free in Tracing
      * CVE-2026-11701: Insufficient validation of untrusted input in Guest View

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-2debc85b3c advisory.

    Update to 149.0.7827.102

      * CVE-2026-11628: Use after free in Ozone
      * CVE-2026-11629: Use after free in Ozone
      * CVE-2026-11630: Use after free in File Input
      * CVE-2026-11631: Use after free in Aura
      * CVE-2026-11632: Use after free in TabStrip
      * CVE-2026-11633: Use after free in Bluetooth
      * CVE-2026-11634: Use after free in Gamepad
      * CVE-2026-11635: Use after free in Bluetooth
      * CVE-2026-11636: Use after free in Autofill
      * CVE-2026-11637: Use after free in Views
      * CVE-2026-11638: Use after free in Printing
      * CVE-2026-11639: Use after free in Compositing
      * CVE-2026-11640: Integer overflow in libyuv
      * CVE-2026-11641: Use after free in Bluetooth
      * CVE-2026-11642: Use after free in Web Apps
      * CVE-2026-11643: Use after free in Proxy
      * CVE-2026-11644: Use after free in Views
      * CVE-2026-11645: Out of bounds memory access in V8
      * CVE-2026-11646: Use after free in ViewTransitions
      * CVE-2026-11647: Use after free in Printing
      * CVE-2026-11648: Use after free in FullScreen
      * CVE-2026-11649: Use after free in V8
      * CVE-2026-11650: Use after free in V8
      * CVE-2026-11651: Use after free in Network
      * CVE-2026-11652: Use after free in Extensions
      * CVE-2026-11653: Insufficient validation of untrusted input in Extensions
      * CVE-2026-11654: Use after free in CameraCapture
      * CVE-2026-11655: Integer overflow in Media
      * CVE-2026-11656: Use after free in ServiceWorker
      * CVE-2026-11657: Use after free in Payments
      * CVE-2026-11658: Insufficient validation of untrusted input in Extensions
      * CVE-2026-11659: Insufficient validation of untrusted input in UI
      * CVE-2026-11660: Insufficient validation of untrusted input in New Tab Page
      * CVE-2026-11661: Use after free in Views
      * CVE-2026-11662: Type Confusion in Bindings
      * CVE-2026-11663: Use after free in Skia
      * CVE-2026-11664: Use after free in Payments
      * CVE-2026-11665: Out of bounds read in Dawn
      * CVE-2026-11666: Insufficient validation of untrusted input in Input
      * CVE-2026-11667: Out of bounds read in WebRTC
      * CVE-2026-11668: Uninitialized Use in Codecs
      * CVE-2026-11669: Integer overflow in Media
      * CVE-2026-11670: Use after free in PDF
      * CVE-2026-11671: Use after free in Navigation
      * CVE-2026-11672: Out of bounds write in GPU
      * CVE-2026-11673: Use after free in InterestGroups
      * CVE-2026-11674: Use after free in Guest View
      * CVE-2026-11675: Insufficient validation of untrusted input in Skia
      * CVE-2026-11676: Insufficient validation of untrusted input in Dawn
      * CVE-2026-11677: Race in Network
      * CVE-2026-11678: Integer overflow in libyuv
      * CVE-2026-11679: Use after free in Codecs
      * CVE-2026-11680: Use after free in Media
      * CVE-2026-11681: Use after free in Ozone
      * CVE-2026-11682: Insufficient validation of untrusted input in Views
      * CVE-2026-11683: Use after free in WebCodecs
      * CVE-2026-11684: Insufficient policy enforcement in Network
      * CVE-2026-11685: Insufficient data validation in MediaCapture
      * CVE-2026-11686: Insufficient validation of untrusted input in Dawn
      * CVE-2026-11687: Use after free in Dawn
      * CVE-2026-11688: Object lifecycle issue in SVG
      * CVE-2026-11689: Insufficient validation of untrusted input in Passwords
      * CVE-2026-11690: Out of bounds read and write in Media
      * CVE-2026-11691: Insufficient validation of untrusted input in New Tab Page
      * CVE-2026-11692: Use after free in Read Anything
      * CVE-2026-11693: Inappropriate implementation in Plugins
      * CVE-2026-11694: Use after free in ServiceWorker
      * CVE-2026-11695: Inappropriate implementation in Passwords
      * CVE-2026-11696: Uninitialized Use in Video
      * CVE-2026-11697: Insufficient validation of untrusted input in UI
      * CVE-2026-11698: Use after free in Bluetooth
      * CVE-2026-11699: Use after free in Bluetooth
      * CVE-2026-11700: Use after free in Tracing
      * CVE-2026-11701: Insufficient validation of untrusted input in Guest View


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-c5c0986fb6 advisory.

    Update to 149.0.7827.102

      * CVE-2026-11628: Use after free in Ozone
      * CVE-2026-11629: Use after free in Ozone
      * CVE-2026-11630: Use after free in File Input
      * CVE-2026-11631: Use after free in Aura
      * CVE-2026-11632: Use after free in TabStrip
      * CVE-2026-11633: Use after free in Bluetooth
      * CVE-2026-11634: Use after free in Gamepad
      * CVE-2026-11635: Use after free in Bluetooth
      * CVE-2026-11636: Use after free in Autofill
      * CVE-2026-11637: Use after free in Views
      * CVE-2026-11638: Use after free in Printing
      * CVE-2026-11639: Use after free in Compositing
      * CVE-2026-11640: Integer overflow in libyuv
      * CVE-2026-11641: Use after free in Bluetooth
      * CVE-2026-11642: Use after free in Web Apps
      * CVE-2026-11643: Use after free in Proxy
      * CVE-2026-11644: Use after free in Views
      * CVE-2026-11645: Out of bounds memory access in V8
      * CVE-2026-11646: Use after free in ViewTransitions
      * CVE-2026-11647: Use after free in Printing
      * CVE-2026-11648: Use after free in FullScreen
      * CVE-2026-11649: Use after free in V8
      * CVE-2026-11650: Use after free in V8
      * CVE-2026-11651: Use after free in Network
      * CVE-2026-11652: Use after free in Extensions
      * CVE-2026-11653: Insufficient validation of untrusted input in Extensions
      * CVE-2026-11654: Use after free in CameraCapture
      * CVE-2026-11655: Integer overflow in Media
      * CVE-2026-11656: Use after free in ServiceWorker
      * CVE-2026-11657: Use after free in Payments
      * CVE-2026-11658: Insufficient validation of untrusted input in Extensions
      * CVE-2026-11659: Insufficient validation of untrusted input in UI
      * CVE-2026-11660: Insufficient validation of untrusted input in New Tab Page
      * CVE-2026-11661: Use after free in Views
      * CVE-2026-11662: Type Confusion in Bindings
      * CVE-2026-11663: Use after free in Skia
      * CVE-2026-11664: Use after free in Payments
      * CVE-2026-11665: Out of bounds read in Dawn
      * CVE-2026-11666: Insufficient validation of untrusted input in Input
      * CVE-2026-11667: Out of bounds read in WebRTC
      * CVE-2026-11668: Uninitialized Use in Codecs
      * CVE-2026-11669: Integer overflow in Media
      * CVE-2026-11670: Use after free in PDF
      * CVE-2026-11671: Use after free in Navigation
      * CVE-2026-11672: Out of bounds write in GPU
      * CVE-2026-11673: Use after free in InterestGroups
      * CVE-2026-11674: Use after free in Guest View
      * CVE-2026-11675: Insufficient validation of untrusted input in Skia
      * CVE-2026-11676: Insufficient validation of untrusted input in Dawn
      * CVE-2026-11677: Race in Network
      * CVE-2026-11678: Integer overflow in libyuv
      * CVE-2026-11679: Use after free in Codecs
      * CVE-2026-11680: Use after free in Media
      * CVE-2026-11681: Use after free in Ozone
      * CVE-2026-11682: Insufficient validation of untrusted input in Views
      * CVE-2026-11683: Use after free in WebCodecs
      * CVE-2026-11684: Insufficient policy enforcement in Network
      * CVE-2026-11685: Insufficient data validation in MediaCapture
      * CVE-2026-11686: Insufficient validation of untrusted input in Dawn
      * CVE-2026-11687: Use after free in Dawn
      * CVE-2026-11688: Object lifecycle issue in SVG
      * CVE-2026-11689: Insufficient validation of untrusted input in Passwords
      * CVE-2026-11690: Out of bounds read and write in Media
      * CVE-2026-11691: Insufficient validation of untrusted input in New Tab Page
      * CVE-2026-11692: Use after free in Read Anything
      * CVE-2026-11693: Inappropriate implementation in Plugins
      * CVE-2026-11694: Use after free in ServiceWorker
      * CVE-2026-11695: Inappropriate implementation in Passwords
      * CVE-2026-11696: Uninitialized Use in Video
      * CVE-2026-11697: Insufficient validation of untrusted input in UI
      * CVE-2026-11698: Use after free in Bluetooth
      * CVE-2026-11699: Use after free in Bluetooth
      * CVE-2026-11700: Use after free in Tracing
      * CVE-2026-11701: Insufficient validation of untrusted input in Guest View


    ----

    Update to 149.0.7827.53

    * fix 429 CVEs ( CVE-2026-10881 through CVE-2026-11309)

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the efa1873c-64a0-11f1-b189-a8a1599412c6 advisory.

    Chrome Releases reports:
    This update includes 74 security fixes:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6337 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6337-1                   security@debian.org     https://www.debian.org/security/                           Andres Salomon     June 10, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : chromium     CVE ID         : CVE-2026-11628 CVE-2026-11629 CVE-2026-11630 CVE-2026-11631                      CVE-2026-11632 CVE-2026-11633 CVE-2026-11634 CVE-2026-11635                      CVE-2026-11636 CVE-2026-11637 CVE-2026-11638 CVE-2026-11639                      CVE-2026-11640 CVE-2026-11641 CVE-2026-11642 CVE-2026-11643                      CVE-2026-11644 CVE-2026-11645 CVE-2026-11646 CVE-2026-11647                      CVE-2026-11648 CVE-2026-11649 CVE-2026-11650 CVE-2026-11651                      CVE-2026-11652 CVE-2026-11653 CVE-2026-11654 CVE-2026-11655                      CVE-2026-11656 CVE-2026-11657 CVE-2026-11658 CVE-2026-11659                      CVE-2026-11660 CVE-2026-11661 CVE-2026-11662 CVE-2026-11663                      CVE-2026-11664 CVE-2026-11665 CVE-2026-11666 CVE-2026-11667                      CVE-2026-11668 CVE-2026-11669 CVE-2026-11670 CVE-2026-11671                      CVE-2026-11672 CVE-2026-11673 CVE-2026-11674 CVE-2026-11675                      CVE-2026-11676 CVE-2026-11677 CVE-2026-11678 CVE-2026-11679                      CVE-2026-11680 CVE-2026-11681 CVE-2026-11682 CVE-2026-11683                      CVE-2026-11684 CVE-2026-11685 CVE-2026-11686 CVE-2026-11687                      CVE-2026-11688 CVE-2026-11689 CVE-2026-11690 CVE-2026-11691                      CVE-2026-11692 CVE-2026-11693 CVE-2026-11694 CVE-2026-11695                      CVE-2026-11696 CVE-2026-11697 CVE-2026-11698 CVE-2026-11699                      CVE-2026-11700 CVE-2026-11701

    Security issues were discovered in Chromium which could result     in the execution of arbitrary code, denial of service, or information     disclosure.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 149.0.7827.102-1~deb12u1.

    For the stable distribution (trixie), these problems have been fixed in     version 149.0.7827.102-1~deb13u1.

    We recommend that you upgrade your chromium packages.

    For the detailed security status of chromium please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/chromium

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Use after free in Bluetooth in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker who     had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (Chromium security severity: Critical) (CVE-2026-11635)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Google Chrome installed on the remote Windows host is prior to 149.0.7827.102. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026_06_stable-channel-update-for-desktop_0153744567 advisory.

  - Use after free in Tracing in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (Chromium security severity: Medium) (CVE-2026-11700)

  - Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.103 allowed     a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML     page. (Chromium security severity: High) (CVE-2026-11658)

  - Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a local attacker to potentially     exploit heap corruption via physical access to the device. (Chromium security severity: Critical)     (CVE-2026-11628)

  - Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) (CVE-2026-11629)

  - Use after free in File Input in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)     (CVE-2026-11630)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 149.0.7827.102. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026_06_stable-channel-update-for-desktop_0153744567 advisory.

  - Use after free in Tracing in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had     compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (Chromium security severity: Medium) (CVE-2026-11700)

  - Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.103 allowed     a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML     page. (Chromium security severity: High) (CVE-2026-11658)

  - Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a local attacker to potentially     exploit heap corruption via physical access to the device. (Chromium security severity: Critical)     (CVE-2026-11628)

  - Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially     exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) (CVE-2026-11629)

  - Use after free in File Input in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)     (CVE-2026-11630)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
329363	Microsoft Edge (Chromium) < 149.0.4022.62 Multiple Vulnerabilities	Nessus	Windows	Local	medium
321008	openSUSE 16 Security Update : chromium (openSUSE-SU-2026:20944-1)	Nessus	SuSE Local Security Checks	Local	medium
320958	Fedora 44 : chromium (2026-2debc85b3c)	Nessus	Fedora Local Security Checks	Local	medium
320935	Fedora 43 : chromium (2026-c5c0986fb6)	Nessus	Fedora Local Security Checks	Local	medium
320571	FreeBSD : chromium -- security fixes (efa1873c-64a0-11f1-b189-a8a1599412c6)	Nessus	FreeBSD Local Security Checks	Local	medium
320492	Debian dsa-6337 : chromium - security update	Nessus	Debian Local Security Checks	Local	medium
320088	Linux Distros Unpatched Vulnerability : CVE-2026-11635	Nessus	Misc.	Local	high
319882	Google Chrome < 149.0.7827.102 Multiple Vulnerabilities	Nessus	Windows	Local	medium
319881	Google Chrome < 149.0.7827.102 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Local	medium

Detections

Analytics

CVE-2026-11635

high

Tenable Plugins

medium

medium

medium

medium

medium

medium

high

medium

medium