Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

The version of Microsoft Edge installed on the remote Windows host is prior to 156.0.4314.58. It is, therefore, affected by multiple vulnerabilities as referenced in the November 4, 2026 advisory.

  - Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to     potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security     severity: Medium) (CVE-2026-121257)

  - Out-of-bounds read in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose     information over a network. (CVE-2026-122518)

  - Use after free in TabStrip in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute     arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-121114)

  - Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker     leveraging social engineering to bypass system access restrictions into a privileged page via a crafted     Chrome extension. (Chromium security severity: Low) (CVE-2026-121101)

  - Use after free in Paint in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute     arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-121117)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 156.0.8078.47. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026_10_stable-channel-update-for-desktop_02018666648 advisory.

  - Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker     leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium     security severity: Medium) (CVE-2026-113264)

  - Use after free in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to     execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)     (CVE-2026-113341)

  - Missing authorization in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker     leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security     severity: High) (CVE-2026-112993)

  - Information leak in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain     cross-origin data via a crafted HTML page. (Chromium security severity: High) (CVE-2026-113000)

  - Incorrect authorization in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to     bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security     severity: Medium) (CVE-2026-113006)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 156.0.8078.47. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026_10_stable-channel-update-for-desktop_02018666648 advisory.

  - Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker     leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium     security severity: Medium) (CVE-2026-113264)

  - Use after free in Skia in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker to     execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)     (CVE-2026-113341)

  - Missing authorization in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker     leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security     severity: High) (CVE-2026-112993)

  - Information leak in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain     cross-origin data via a crafted HTML page. (Chromium security severity: High) (CVE-2026-113000)

  - Incorrect authorization in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to     bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security     severity: Medium) (CVE-2026-113006)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
374566	Microsoft Edge (Chromium) < 156.0.4314.58 Multiple Vulnerabilities	Nessus	Windows	Local	critical
369056	Google Chrome < 156.0.8078.47 Multiple Vulnerabilities	Nessus	Windows	Local	high
369055	Google Chrome < 156.0.8078.47 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Local	high

Detections

Analytics

CVE-2026-120930

medium

Tenable Plugins

critical

high

high