Heap buffer overflow in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Critical)

The version of Microsoft Edge installed on the remote Windows host is prior to 149.0.4022.69. It is, therefore, affected by multiple vulnerabilities as referenced in the June 15, 2026 advisory.

  - Inappropriate implementation in Mojo in Google Chrome on Windows prior to 149.0.7827.115 allowed a local     attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High)     (CVE-2026-12018)

  - Use after free in Core in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to     execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical) (CVE-2026-12007)

  - Use after free in DigitalCredentials in Google Chrome prior to 149.0.7827.115 allowed a remote attacker     who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (Chromium security severity: Critical) (CVE-2026-12008)

  - Insufficient validation of untrusted input in Accessibility in Google Chrome on Mac prior to     149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a     sandbox escape via a crafted HTML page. (Chromium security severity: Critical) (CVE-2026-12009)

  - Heap buffer overflow in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker     who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (Chromium security severity: Critical) (CVE-2026-12010)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-40cf884ac9 advisory.

    Update to 149.0.7827.114

      * CVE-2026-12007: Use after free  Core
      * CVE-2026-12008: Use after free  DigitalCredentials
      * CVE-2026-12009: Insufficient validation of untrusted input  Accessibility
      * CVE-2026-12010: Heap buffer overflow  GPU
      * CVE-2026-12011: Use after free  WebMIDI
      * CVE-2026-12012: Use after free  Network
      * CVE-2026-12013: Use after free  Media
      * CVE-2026-12014: Use after free  Cast
      * CVE-2026-12015: Use after free  Autofill
      * CVE-2026-12016: Insufficient validation of untrusted input  DevTools
      * CVE-2026-12017: Insufficient validation of untrusted input  Extensions
      * CVE-2026-12018: Inappropriate implementation  Mojo
      * CVE-2026-12019: Out of bounds write  Codecs
      * CVE-2026-12020: Use after free  Autofill
      * CVE-2026-12022: Race  Safe Browsing
      * CVE-2026-12023: Use after free  GPU
      * CVE-2026-12024: Insufficient policy enforcement  DevTools
      * CVE-2026-12025: Insufficient validation of untrusted input  Network
      * CVE-2026-12026: Out of bounds read  Video
      * CVE-2026-12027: Insufficient policy enforcement  Headless
      * CVE-2026-12028: Use after free  GPU
      * CVE-2026-12029: Use after free  Video
      * CVE-2026-12030: Heap buffer overflow  GPU
      * CVE-2026-12031: Inappropriate implementation  Views
      * CVE-2026-12032: Inappropriate implementation  Passwords
      * CVE-2026-12033: Out of bounds read  VideoCapture
      * CVE-2026-12034: Insufficient validation of untrusted input  Linux Toolkit Theming
      * CVE-2026-12035: Use after free  Views
    - Disable AI Mode settings


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-59f46c195f advisory.

    Update to 149.0.7827.114

      * CVE-2026-12007: Use after free  Core
      * CVE-2026-12008: Use after free  DigitalCredentials
      * CVE-2026-12009: Insufficient validation of untrusted input  Accessibility
      * CVE-2026-12010: Heap buffer overflow  GPU
      * CVE-2026-12011: Use after free  WebMIDI
      * CVE-2026-12012: Use after free  Network
      * CVE-2026-12013: Use after free  Media
      * CVE-2026-12014: Use after free  Cast
      * CVE-2026-12015: Use after free  Autofill
      * CVE-2026-12016: Insufficient validation of untrusted input  DevTools
      * CVE-2026-12017: Insufficient validation of untrusted input  Extensions
      * CVE-2026-12018: Inappropriate implementation  Mojo
      * CVE-2026-12019: Out of bounds write  Codecs
      * CVE-2026-12020: Use after free  Autofill
      * CVE-2026-12022: Race  Safe Browsing
      * CVE-2026-12023: Use after free  GPU
      * CVE-2026-12024: Insufficient policy enforcement  DevTools
      * CVE-2026-12025: Insufficient validation of untrusted input  Network
      * CVE-2026-12026: Out of bounds read  Video
      * CVE-2026-12027: Insufficient policy enforcement  Headless
      * CVE-2026-12028: Use after free  GPU
      * CVE-2026-12029: Use after free  Video
      * CVE-2026-12030: Heap buffer overflow  GPU
      * CVE-2026-12031: Inappropriate implementation  Views
      * CVE-2026-12032: Inappropriate implementation  Passwords
      * CVE-2026-12033: Out of bounds read  VideoCapture
      * CVE-2026-12034: Insufficient validation of untrusted input  Linux Toolkit Theming
      * CVE-2026-12035: Use after free  Views
    - Disable AI Mode settings


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 1466c84c-68b1-11f1-8de5-a8a1599412c6 advisory.

    Chrome Releases reports:
    This update includes 28 security fixes:

Tenable has extracted the preceding description block directly from the FreeBSD security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 / 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6344 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6344-1                   security@debian.org     https://www.debian.org/security/                           Andres Salomon     June 13, 2026                         https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : chromium     CVE ID         : CVE-2026-12007 CVE-2026-12008 CVE-2026-12009 CVE-2026-12010                      CVE-2026-12011 CVE-2026-12012 CVE-2026-12013 CVE-2026-12014                      CVE-2026-12015 CVE-2026-12016 CVE-2026-12017 CVE-2026-12018                      CVE-2026-12019 CVE-2026-12020 CVE-2026-12022 CVE-2026-12023                      CVE-2026-12024 CVE-2026-12025 CVE-2026-12026 CVE-2026-12027                      CVE-2026-12028 CVE-2026-12029 CVE-2026-12030 CVE-2026-12031                      CVE-2026-12032 CVE-2026-12033 CVE-2026-12034 CVE-2026-12035

    Security issues were discovered in Chromium which could result     in the execution of arbitrary code, denial of service, or information     disclosure.

    For the oldstable distribution (bookworm), these problems have been fixed     in version 149.0.7827.114-1~deb12u1.

    For the stable distribution (trixie), these problems have been fixed in     version 149.0.7827.114-1~deb13u1.

    We recommend that you upgrade your chromium packages.

    For the detailed security status of chromium please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/chromium

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Heap buffer overflow in GPU in Google Chrome on Android prior to 149.0.7827.115 allowed a remote attacker     who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (Chromium security severity: Critical) (CVE-2026-12010)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of Google Chrome installed on the remote Windows host is prior to 149.0.7827.114. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026_06_stable-channel-update-for-desktop_01962725236 advisory.

  - Use after free in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-12035)

  - Out of bounds read in Video in Google Chrome on ChromeOS prior to 149.0.7827.115 allowed a remote attacker     who had compromised the renderer process to obtain potentially sensitive information from process memory     via a crafted HTML page. (Chromium security severity: High) (CVE-2026-12026)

  - Use after free in Core in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to     execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical) (CVE-2026-12007)

  - Use after free in DigitalCredentials in Google Chrome prior to 149.0.7827.115 allowed a remote attacker     who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (Chromium security severity: Critical) (CVE-2026-12008)

  - Insufficient validation of untrusted input in Accessibility in Google Chrome on Mac prior to     149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a     sandbox escape via a crafted HTML page. (Chromium security severity: Critical) (CVE-2026-12009)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 149.0.7827.114. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026_06_stable-channel-update-for-desktop_01962725236 advisory.

  - Use after free in Views in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-12035)

  - Out of bounds read in Video in Google Chrome on ChromeOS prior to 149.0.7827.115 allowed a remote attacker     who had compromised the renderer process to obtain potentially sensitive information from process memory     via a crafted HTML page. (Chromium security severity: High) (CVE-2026-12026)

  - Use after free in Core in Google Chrome on Windows prior to 149.0.7827.115 allowed a remote attacker to     execute arbitrary code via a crafted HTML page. (Chromium security severity: Critical) (CVE-2026-12007)

  - Use after free in DigitalCredentials in Google Chrome prior to 149.0.7827.115 allowed a remote attacker     who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (Chromium security severity: Critical) (CVE-2026-12008)

  - Insufficient validation of untrusted input in Accessibility in Google Chrome on Mac prior to     149.0.7827.115 allowed a remote attacker who had compromised the renderer process to potentially perform a     sandbox escape via a crafted HTML page. (Chromium security severity: Critical) (CVE-2026-12009)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
329364	Microsoft Edge (Chromium) < 149.0.4022.69 Multiple Vulnerabilities	Nessus	Windows	Local	high
321637	Fedora 43 : chromium (2026-40cf884ac9)	Nessus	Fedora Local Security Checks	Local	medium
321432	Fedora 44 : chromium (2026-59f46c195f)	Nessus	Fedora Local Security Checks	Local	medium
321173	FreeBSD : chromium -- security fixes (1466c84c-68b1-11f1-8de5-a8a1599412c6)	Nessus	FreeBSD Local Security Checks	Local	medium
320973	Debian dsa-6344 : chromium - security update	Nessus	Debian Local Security Checks	Local	medium
320805	Linux Distros Unpatched Vulnerability : CVE-2026-12010	Nessus	Misc.	Local	high
320656	Google Chrome < 149.0.7827.114 Multiple Vulnerabilities	Nessus	Windows	Local	medium
320655	Google Chrome < 149.0.7827.114 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Local	medium

Detections

Analytics

CVE-2026-12010

high

Tenable Plugins

high

medium

medium

medium

medium

high

medium

medium