Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: High)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain
    cross-origin data via a crafted HTML page. (Chromium security severity: High) (CVE-2026-91740)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-2026_69098 advisory.

    * chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page (CVE-2026-19154)

    * chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium (CVE-2026-19173)

    * chromium-browser: Skia in Google Chrome: Cross-origin data leakage via uninitialized use     (CVE-2026-19161)

    * chromium-browser: Skia: Arbitrary code execution via crafted HTML page (CVE-2026-19176)

    * chromium-browser: Chromium: Information leak allows web origin policy bypass (CVE-2026-76041)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-28984)

    * webkitgtk: Visiting a website may lead to an app denial-of-service (CVE-2026-43804)

    * webkitgtk: Websites may know if the user has visited a given link (CVE-2026-64713)

    * webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy (CVE-2026-64728)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination     (CVE-2026-64787)

    * webkitgtk: Visiting a website that frames malicious content may lead to UI spoofing (CVE-2026-64730)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64757)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64783)

    * webkitgtk: use-after-free of JSCValue function parameters (CVE-2026-78376)

    * chromium-browser: Skia: Information disclosure via out-of-bounds read in crafted media file     (CVE-2026-79020)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-43795)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2026-64715)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64718)

    * webkitgtk: Visiting a maliciously crafted website may leak sensitive data (CVE-2026-64778)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64779)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64780)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64782)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64784)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65331)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65332)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65334)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65335)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65336)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65337)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65338)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65340)

    * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2026-65341)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65351)

    * webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature (CVE-2026-83596)

    * chromium-browser: skia: chromium-browser: Information leak in Skia (CVE-2026-84359)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination     (CVE-2026-84635)

    * webkitgtk: Processing maliciously crafted web content may disclose sensitive user information     (CVE-2026-64753)

Tenable has extracted the preceding description block directly from the CIQ security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The AlmaLinux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790805563 advisory.

  - Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-     origin data via a crafted HTML page. (Chromium security severity: Medium) (CVE-2026-17771)

  - The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS     18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Visiting a     maliciously crafted website may leak sensitive data. (CVE-2026-64778)

  - A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari     26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27.
    Processing maliciously crafted web content may lead to an unexpected Safari crash. (CVE-2026-64779)

  - This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS     18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing     maliciously crafted web content may lead to an unexpected Safari crash. (CVE-2026-65351)

  - Improper state validation in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who     had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium     security severity: High) (CVE-2026-91733)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Rocky Linux 9.6 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1790805563 advisory.

  - Uninitialized Use in Skia in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-     origin data via a crafted HTML page. (Chromium security severity: Medium) (CVE-2026-17771)

  - The issue was addressed with improved checks. This issue is fixed in Safari 26.6.1, iOS 18.7.10 and iPadOS     18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, tvOS 27, visionOS 27, watchOS 27. Visiting a     maliciously crafted website may leak sensitive data. (CVE-2026-64778)

  - A memory corruption vulnerability was addressed with improved locking. This issue is fixed in Safari     26.6.1, iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27.
    Processing maliciously crafted web content may lead to an unexpected Safari crash. (CVE-2026-64779)

  - This issue was addressed through improved state management. This issue is fixed in Safari 26.6.1, iOS     18.7.10 and iPadOS 18.7.10, iOS 26.6.1 and iPadOS 26.6.1, macOS Tahoe 26.6.2, visionOS 27. Processing     maliciously crafted web content may lead to an unexpected Safari crash. (CVE-2026-65351)

  - Improper state validation in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who     had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium     security severity: High) (CVE-2026-91733)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-40db9b80a2 advisory.

    Update to 2.54.0:

     * Switch web process compositor to use Skia instead of TextureMapper.
     * Improved damage handling that is now also used during the composition to limit the composited areas.
     * Implement GPU atlas creation and replay substitution for batched raster image uploads.
     * Media capability reporting is more accurate.
     * Video decoding limits are now respected in media capabilities queries.
     * Add new improved API for page favicons.
     * Add magnification property to WebKitWebView to handle visual scaling.
     * Add new API to allow setting a per-navigation custom User-Agent to WebKitWebsitePolicies.
     * Remove the option to use cairo for 2D rendering.

    WebKit Security fixes from 2.54.0: CVE-2026-84635, CVE-2026-64753, CVE-2026-64715, CVE-2026-64778,     CVE-2026-64779, CVE-2026-64780, CVE-2026-64782, CVE-2026-64784, CVE-2026-65331, CVE-2026-65332,     CVE-2026-65333, CVE-2026-65334, CVE-2026-65335, CVE-2026-65336, CVE-2026-65337, CVE-2026-65338,     CVE-2026-65340, CVE-2026-65341, CVE-2026-65351, CVE-2026-78376, CVE-2026-83596.

    WebKit security fixes from 2.52.6: CVE-2026-43804, CVE-2026-64713, CVE-2026-64728, CVE-2026-64730,     CVE-2026-64757, CVE-2026-64783

    This update also fixes a couple hundred or so ANGLE CVEs and several dozen Skia CVEs.

    This update [breaks some styles in Evolution](https://bugs.webkit.org/show_bug.cgi?id=322568). Sorry about     that.








Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1904:08 advisory.

    * chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page (CVE-2026-19154)
      * chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium (CVE-2026-19173)
      * chromium-browser: Skia in Google Chrome: Cross-origin data leakage via uninitialized use     (CVE-2026-19161)
      * chromium-browser: Skia: Arbitrary code execution via crafted HTML page (CVE-2026-19176)
      * chromium-browser: Chromium: Information leak allows web origin policy bypass (CVE-2026-76041)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-28984)
      * webkitgtk: Visiting a website may lead to an app denial-of-service (CVE-2026-43804)
      * webkitgtk: Websites may know if the user has visited a given link (CVE-2026-64713)
      * webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy (CVE-2026-64728)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination     (CVE-2026-64787)
      * webkitgtk: Visiting a website that frames malicious content may lead to UI spoofing (CVE-2026-64730)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64757)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64783)
      * webkitgtk: use-after-free of JSCValue function parameters (CVE-2026-78376)
      * chromium-browser: Skia: Information disclosure via out-of-bounds read in crafted media file     (CVE-2026-79020)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-43795)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2026-64715)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64718)
      * webkitgtk: Visiting a maliciously crafted website may leak sensitive data (CVE-2026-64778)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64779)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64780)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64782)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64784)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65331)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65332)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65334)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65335)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65336)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65337)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65338)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65340)
      * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2026-65341)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65351)
      * webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature     (CVE-2026-83596)
      * chromium-browser: skia: chromium-browser: Information leak in Skia (CVE-2026-84359)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination     (CVE-2026-84635)
      * webkitgtk: Processing maliciously crafted web content may disclose sensitive user information     (CVE-2026-64753)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dd12c89e57 advisory.

    Update to 153.0.8010.52

      * CVE-2026-91708: Race condition in Network
      * CVE-2026-91709: Type confusion in ServiceWorker
      * CVE-2026-91710: Use after free in WebAppInstalls
      * CVE-2026-91711: Out of bounds write in ServiceWorker
      * CVE-2026-91712: Race condition in Extensions
      * CVE-2026-91713: Missing authorization in Browser
      * CVE-2026-91714: Observable discrepancy in Fonts
      * CVE-2026-91715: Type confusion in ServiceWorker
      * CVE-2026-91716: Use after free in Auth
      * CVE-2026-91717: Missing authorization in Android
      * CVE-2026-91718: Use after free in Core
      * CVE-2026-91719: Code injection in XML
      * CVE-2026-91720: Uninitialized resource in ANGLE
      * CVE-2026-91721: Use after free in Internals
      * CVE-2026-91722: Use after free in Input
      * CVE-2026-91723: Race condition in WebAppInstalls
      * CVE-2026-91724: Use after free in Input
      * CVE-2026-91725: Observable discrepancy in CSS
      * CVE-2026-91726: Out of bounds read in WebGL
      * CVE-2026-91727: Incorrect reference resolution in Extensions
      * CVE-2026-91728: Integer overflow in V8
      * CVE-2026-91729: Use after free in DigitalCredentials
      * CVE-2026-91730: Incomplete cleanup in GetUserMedia
      * CVE-2026-91731: Type confusion in Compositing
      * CVE-2026-91732: Missing authorization in AppManifest
      * CVE-2026-91733: Improper state validation in Skia
      * CVE-2026-91734: Incorrect authorization in Core
      * CVE-2026-91735: Incorrect authorization in WebUI
      * CVE-2026-91736: Use after free in DOM
      * CVE-2026-91737: Use after free in PDF
      * CVE-2026-91738: Improper input validation in ANGLE
      * CVE-2026-91739: Missing authorization in Transactions Platform
      * CVE-2026-91740: Uninitialized resource in Skia
      * CVE-2026-91741: Type confusion in CacheStorage
      * CVE-2026-91742: Confused deputy in PriceTracking
      * CVE-2026-91743: Race condition in Core
      * CVE-2026-91744: Race condition in PlatformIntegration
      * CVE-2026-91745: Use after free in V8
      * CVE-2026-91746: Integer overflow in Compositing
      * CVE-2026-91747: Use after free in Skia
      * CVE-2026-91748: Race condition in Extensions
      * CVE-2026-91749: Use after free in Workers
      * CVE-2026-93372: Buffer overflow in WebGL
      * CVE-2026-93373: Use after free in Extensions
      * CVE-2026-93374: Use after free in Dawn
      * CVE-2026-93375: Incorrect reference resolution in Tracing
      * CVE-2026-93376: Out of bounds read in DataTransfer
      * CVE-2026-93377: Type confusion in V8
      * CVE-2026-93378: Missing authorization in Storage
      * CVE-2026-93379: Incorrect authorization in ORB
      * CVE-2026-93380: Race condition in FileSystem
      * CVE-2026-93381: Buffer overflow in PDFium
      * CVE-2026-93382: Use after free in PDFium
      * CVE-2026-93383: Information leak in Permissions
      * CVE-2026-93384: Server-side request forgery in Omnibox
      * CVE-2026-93385: Information leak in Paint
      * CVE-2026-93386: UI misrepresentation in WebAppInstalls
      * CVE-2026-93387: Improper state validation in Skia


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain     cross-origin data via a crafted HTML page. (Chromium security severity: High) (CVE-2026-91740)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f910229c11 advisory.

    Update to 153.0.8010.52

      * CVE-2026-91708: Race condition in Network
      * CVE-2026-91709: Type confusion in ServiceWorker
      * CVE-2026-91710: Use after free in WebAppInstalls
      * CVE-2026-91711: Out of bounds write in ServiceWorker
      * CVE-2026-91712: Race condition in Extensions
      * CVE-2026-91713: Missing authorization in Browser
      * CVE-2026-91714: Observable discrepancy in Fonts
      * CVE-2026-91715: Type confusion in ServiceWorker
      * CVE-2026-91716: Use after free in Auth
      * CVE-2026-91717: Missing authorization in Android
      * CVE-2026-91718: Use after free in Core
      * CVE-2026-91719: Code injection in XML
      * CVE-2026-91720: Uninitialized resource in ANGLE
      * CVE-2026-91721: Use after free in Internals
      * CVE-2026-91722: Use after free in Input
      * CVE-2026-91723: Race condition in WebAppInstalls
      * CVE-2026-91724: Use after free in Input
      * CVE-2026-91725: Observable discrepancy in CSS
      * CVE-2026-91726: Out of bounds read in WebGL
      * CVE-2026-91727: Incorrect reference resolution in Extensions
      * CVE-2026-91728: Integer overflow in V8
      * CVE-2026-91729: Use after free in DigitalCredentials
      * CVE-2026-91730: Incomplete cleanup in GetUserMedia
      * CVE-2026-91731: Type confusion in Compositing
      * CVE-2026-91732: Missing authorization in AppManifest
      * CVE-2026-91733: Improper state validation in Skia
      * CVE-2026-91734: Incorrect authorization in Core
      * CVE-2026-91735: Incorrect authorization in WebUI
      * CVE-2026-91736: Use after free in DOM
      * CVE-2026-91737: Use after free in PDF
      * CVE-2026-91738: Improper input validation in ANGLE
      * CVE-2026-91739: Missing authorization in Transactions Platform
      * CVE-2026-91740: Uninitialized resource in Skia
      * CVE-2026-91741: Type confusion in CacheStorage
      * CVE-2026-91742: Confused deputy in PriceTracking
      * CVE-2026-91743: Race condition in Core
      * CVE-2026-91744: Race condition in PlatformIntegration
      * CVE-2026-91745: Use after free in V8
      * CVE-2026-91746: Integer overflow in Compositing
      * CVE-2026-91747: Use after free in Skia
      * CVE-2026-91748: Race condition in Extensions
      * CVE-2026-91749: Use after free in Workers
      * CVE-2026-93372: Buffer overflow in WebGL
      * CVE-2026-93373: Use after free in Extensions
      * CVE-2026-93374: Use after free in Dawn
      * CVE-2026-93375: Incorrect reference resolution in Tracing
      * CVE-2026-93376: Out of bounds read in DataTransfer
      * CVE-2026-93377: Type confusion in V8
      * CVE-2026-93378: Missing authorization in Storage
      * CVE-2026-93379: Incorrect authorization in ORB
      * CVE-2026-93380: Race condition in FileSystem
      * CVE-2026-93381: Buffer overflow in PDFium
      * CVE-2026-93382: Use after free in PDFium
      * CVE-2026-93383: Information leak in Permissions
      * CVE-2026-93384: Server-side request forgery in Omnibox
      * CVE-2026-93385: Information leak in Paint
      * CVE-2026-93386: UI misrepresentation in WebAppInstalls
      * CVE-2026-93387: Improper state validation in Skia


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:69098 advisory.

    * chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page (CVE-2026-19154)

    * chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium (CVE-2026-19173)

    * chromium-browser: Skia in Google Chrome: Cross-origin data leakage via uninitialized use     (CVE-2026-19161)

    * chromium-browser: Skia: Arbitrary code execution via crafted HTML page (CVE-2026-19176)

    * chromium-browser: Chromium: Information leak allows web origin policy bypass (CVE-2026-76041)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-28984)

    * webkitgtk: Visiting a website may lead to an app denial-of-service (CVE-2026-43804)

    * webkitgtk: Websites may know if the user has visited a given link (CVE-2026-64713)

    * webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy (CVE-2026-64728)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination     (CVE-2026-64787)

    * webkitgtk: Visiting a website that frames malicious content may lead to UI spoofing (CVE-2026-64730)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64757)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64783)

    * webkitgtk: use-after-free of JSCValue function parameters (CVE-2026-78376)

    * chromium-browser: Skia: Information disclosure via out-of-bounds read in crafted media file     (CVE-2026-79020)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-43795)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2026-64715)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64718)

    * webkitgtk: Visiting a maliciously crafted website may leak sensitive data (CVE-2026-64778)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64779)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64780)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64782)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64784)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65331)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65332)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65334)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65335)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65336)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65337)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65338)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65340)

    * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2026-65341)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65351)

    * webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature (CVE-2026-83596)

    * chromium-browser: skia: chromium-browser: Information leak in Skia (CVE-2026-84359)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination     (CVE-2026-84635)

    * webkitgtk: Processing maliciously crafted web content may disclose sensitive user information     (CVE-2026-64753)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:69098 advisory.

    * chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page (CVE-2026-19154)
      * chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium (CVE-2026-19173)
      * chromium-browser: Skia in Google Chrome: Cross-origin data leakage via uninitialized use     (CVE-2026-19161)
      * chromium-browser: Skia: Arbitrary code execution via crafted HTML page (CVE-2026-19176)
      * chromium-browser: Chromium: Information leak allows web origin policy bypass (CVE-2026-76041)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-28984)
      * webkitgtk: Visiting a website may lead to an app denial-of-service (CVE-2026-43804)
      * webkitgtk: Websites may know if the user has visited a given link (CVE-2026-64713)
      * webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy (CVE-2026-64728)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination     (CVE-2026-64787)
      * webkitgtk: Visiting a website that frames malicious content may lead to UI spoofing (CVE-2026-64730)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64757)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64783)
      * webkitgtk: use-after-free of JSCValue function parameters (CVE-2026-78376)
      * chromium-browser: Skia: Information disclosure via out-of-bounds read in crafted media file     (CVE-2026-79020)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-43795)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2026-64715)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64718)
      * webkitgtk: Visiting a maliciously crafted website may leak sensitive data (CVE-2026-64778)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64779)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64780)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64782)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64784)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65331)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65332)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65334)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65335)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65336)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65337)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65338)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65340)
      * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2026-65341)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65351)
      * webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature     (CVE-2026-83596)
      * chromium-browser: skia: chromium-browser: Information leak in Skia (CVE-2026-84359)
      * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination     (CVE-2026-84635)
      * webkitgtk: Processing maliciously crafted web content may disclose sensitive user information     (CVE-2026-64753)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69098 advisory.

    WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

    Security Fix(es):

    * chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page (CVE-2026-19154)

    * chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium (CVE-2026-19173)

    * chromium-browser: Skia in Google Chrome: Cross-origin data leakage via uninitialized use     (CVE-2026-19161)

    * chromium-browser: Skia: Arbitrary code execution via crafted HTML page (CVE-2026-19176)

    * chromium-browser: Chromium: Information leak allows web origin policy bypass (CVE-2026-76041)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-28984)

    * webkitgtk: Visiting a website may lead to an app denial-of-service (CVE-2026-43804)

    * webkitgtk: Websites may know if the user has visited a given link (CVE-2026-64713)

    * webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy (CVE-2026-64728)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination     (CVE-2026-64787)

    * webkitgtk: Visiting a website that frames malicious content may lead to UI spoofing (CVE-2026-64730)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64757)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64783)

    * webkitgtk: use-after-free of JSCValue function parameters (CVE-2026-78376)

    * chromium-browser: Skia: Information disclosure via out-of-bounds read in crafted media file     (CVE-2026-79020)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-43795)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash     (CVE-2026-64715)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64718)

    * webkitgtk: Visiting a maliciously crafted website may leak sensitive data (CVE-2026-64778)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64779)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64780)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64782)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-64784)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65331)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65332)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65334)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65335)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65336)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65337)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65338)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65340)

    * webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2026-65341)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash     (CVE-2026-65351)

    * webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature (CVE-2026-83596)

    * chromium-browser: skia: chromium-browser: Information leak in Skia (CVE-2026-84359)

    * webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination     (CVE-2026-84635)

    * webkitgtk: Processing maliciously crafted web content may disclose sensitive user information     (CVE-2026-64753)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4790 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4790-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     September 21, 2026                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : chromium     Version        : 153.0.8010.52-1~deb12u1     CVE ID         : CVE-2026-87429 CVE-2026-87430 CVE-2026-87431 CVE-2026-87432                      CVE-2026-87433 CVE-2026-87434 CVE-2026-87435 CVE-2026-87436                      CVE-2026-87437 CVE-2026-87438 CVE-2026-87439 CVE-2026-87440                      CVE-2026-87441 CVE-2026-87442 CVE-2026-87443 CVE-2026-87444                      CVE-2026-87445 CVE-2026-87446 CVE-2026-87447 CVE-2026-87448                      CVE-2026-87449 CVE-2026-87450 CVE-2026-87451 CVE-2026-87452                      CVE-2026-87453 CVE-2026-87454 CVE-2026-87455 CVE-2026-87456                      CVE-2026-87457 CVE-2026-87458 CVE-2026-87459 CVE-2026-87460                      CVE-2026-87461 CVE-2026-87462 CVE-2026-87463 CVE-2026-87464                      CVE-2026-87465 CVE-2026-87466 CVE-2026-87467 CVE-2026-87468                      CVE-2026-87469 CVE-2026-87470 CVE-2026-87471 CVE-2026-87472                      CVE-2026-87473 CVE-2026-87474 CVE-2026-87475 CVE-2026-87476                      CVE-2026-87477 CVE-2026-87478 CVE-2026-87479 CVE-2026-87480                      CVE-2026-87481 CVE-2026-87482 CVE-2026-87483 CVE-2026-87484                      CVE-2026-87485 CVE-2026-87486 CVE-2026-87487 CVE-2026-87488                      CVE-2026-87489 CVE-2026-87490 CVE-2026-87491 CVE-2026-87492                      CVE-2026-87493 CVE-2026-87494 CVE-2026-87495 CVE-2026-87496                      CVE-2026-87497 CVE-2026-87498 CVE-2026-87499 CVE-2026-87500                      CVE-2026-87501 CVE-2026-87502 CVE-2026-87503 CVE-2026-87504                      CVE-2026-87505 CVE-2026-87506 CVE-2026-87507 CVE-2026-87508                      CVE-2026-87509 CVE-2026-87510 CVE-2026-87511 CVE-2026-87512                      CVE-2026-87513 CVE-2026-87514 CVE-2026-87515 CVE-2026-87516                      CVE-2026-87517 CVE-2026-87518 CVE-2026-87519 CVE-2026-87520                      CVE-2026-87521 CVE-2026-87522 CVE-2026-87523 CVE-2026-87524                      CVE-2026-87525 CVE-2026-87526 CVE-2026-87527 CVE-2026-87528                      CVE-2026-87529 CVE-2026-87530 CVE-2026-87531 CVE-2026-87532                      CVE-2026-87533 CVE-2026-87534 CVE-2026-87535 CVE-2026-87536                      CVE-2026-87537 CVE-2026-87538 CVE-2026-87539 CVE-2026-87540                      CVE-2026-87541 CVE-2026-87542 CVE-2026-87543 CVE-2026-87544                      CVE-2026-87545 CVE-2026-87546 CVE-2026-87547 CVE-2026-87548                      CVE-2026-87549 CVE-2026-87550 CVE-2026-87551 CVE-2026-87552                      CVE-2026-87553 CVE-2026-87554 CVE-2026-87555 CVE-2026-87556                      CVE-2026-87557 CVE-2026-87558 CVE-2026-87559 CVE-2026-87560                      CVE-2026-87561 CVE-2026-87562 CVE-2026-87563 CVE-2026-87564                      CVE-2026-87565 CVE-2026-87566 CVE-2026-87567 CVE-2026-87568                      CVE-2026-87569 CVE-2026-87570 CVE-2026-87571 CVE-2026-87572                      CVE-2026-87573 CVE-2026-87574 CVE-2026-87575 CVE-2026-87576                      CVE-2026-87577 CVE-2026-87578 CVE-2026-87579 CVE-2026-87580                      CVE-2026-87581 CVE-2026-87582 CVE-2026-87583 CVE-2026-87584                      CVE-2026-87585 CVE-2026-87586 CVE-2026-87587 CVE-2026-87588                      CVE-2026-87589 CVE-2026-87590 CVE-2026-87591 CVE-2026-87592                      CVE-2026-87593 CVE-2026-87594 CVE-2026-87595 CVE-2026-87596                      CVE-2026-87597 CVE-2026-87598 CVE-2026-87599 CVE-2026-87600                      CVE-2026-87601 CVE-2026-87602 CVE-2026-87603 CVE-2026-87604                      CVE-2026-87605 CVE-2026-87606 CVE-2026-87607 CVE-2026-87608                      CVE-2026-87609 CVE-2026-87610 CVE-2026-87611 CVE-2026-87612                      CVE-2026-87613 CVE-2026-87614 CVE-2026-87615 CVE-2026-87616                      CVE-2026-87617 CVE-2026-87618 CVE-2026-87619 CVE-2026-87620                      CVE-2026-87621 CVE-2026-87622 CVE-2026-87623 CVE-2026-87624                      CVE-2026-87625 CVE-2026-87626 CVE-2026-87627 CVE-2026-87628                      CVE-2026-87629 CVE-2026-87630 CVE-2026-87631 CVE-2026-87632                      CVE-2026-87633 CVE-2026-87634 CVE-2026-87635 CVE-2026-87636                      CVE-2026-87637 CVE-2026-87638 CVE-2026-87639 CVE-2026-87640                      CVE-2026-87641 CVE-2026-87642 CVE-2026-87643 CVE-2026-87644                      CVE-2026-87645 CVE-2026-87646 CVE-2026-87647 CVE-2026-87648                      CVE-2026-87649 CVE-2026-87650 CVE-2026-87651 CVE-2026-87652                      CVE-2026-87653 CVE-2026-87654 CVE-2026-87655 CVE-2026-87656                      CVE-2026-87657 CVE-2026-87658 CVE-2026-91708 CVE-2026-91709                      CVE-2026-91710 CVE-2026-91711 CVE-2026-91712 CVE-2026-91713                      CVE-2026-91714 CVE-2026-91715 CVE-2026-91716 CVE-2026-91717                      CVE-2026-91718 CVE-2026-91719 CVE-2026-91720 CVE-2026-91721                      CVE-2026-91722 CVE-2026-91723 CVE-2026-91724 CVE-2026-91725                      CVE-2026-91726 CVE-2026-91727 CVE-2026-91728 CVE-2026-91729                      CVE-2026-91730 CVE-2026-91731 CVE-2026-91732 CVE-2026-91733                      CVE-2026-91734 CVE-2026-91735 CVE-2026-91736 CVE-2026-91737                      CVE-2026-91738 CVE-2026-91739 CVE-2026-91740 CVE-2026-91741                      CVE-2026-91742 CVE-2026-91743 CVE-2026-91744 CVE-2026-91745                      CVE-2026-91746 CVE-2026-91747 CVE-2026-91748 CVE-2026-91749                      CVE-2026-93372 CVE-2026-93373 CVE-2026-93374 CVE-2026-93375                      CVE-2026-93376 CVE-2026-93377 CVE-2026-93378 CVE-2026-93379                      CVE-2026-93380 CVE-2026-93381 CVE-2026-93382 CVE-2026-93383                      CVE-2026-93384 CVE-2026-93385 CVE-2026-93386 CVE-2026-93387

    Security issues were discovered in Chromium which could result     in the execution of arbitrary code, denial of service, or information     disclosure.

    For Debian 12 bookworm, these problems have been fixed in version     153.0.8010.52-1~deb12u1.

    We recommend that you upgrade your chromium packages.

    For the detailed security status of chromium please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/chromium

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Microsoft Edge installed on the remote Windows host is prior to 153.0.4234.46. It is, therefore, affected by multiple vulnerabilities as referenced in the September 17, 2026 advisory.

  - Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web     origin policy via a crafted HTML page. (Chromium security severity: Low) (CVE-2026-91719)

  - Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had     compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security     severity: High) (CVE-2026-91708)

  - Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to     execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-91709, CVE-2026-91715)

  - Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to     execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-91710)

  - Out of bounds write in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to     execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-91711)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6506 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6506-1                   security@debian.org     https://www.debian.org/security/                           Andres Salomon     September 17, 2026                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : chromium     CVE ID         : CVE-2026-87429 CVE-2026-87430 CVE-2026-87431 CVE-2026-87432                      CVE-2026-87433 CVE-2026-87434 CVE-2026-87435 CVE-2026-87436                      CVE-2026-87437 CVE-2026-87438 CVE-2026-87439 CVE-2026-87440                      CVE-2026-87441 CVE-2026-87442 CVE-2026-87443 CVE-2026-87444                      CVE-2026-87445 CVE-2026-87446 CVE-2026-87447 CVE-2026-87448                      CVE-2026-87449 CVE-2026-87450 CVE-2026-87451 CVE-2026-87452                      CVE-2026-87453 CVE-2026-87454 CVE-2026-87455 CVE-2026-87456                      CVE-2026-87457 CVE-2026-87458 CVE-2026-87459 CVE-2026-87460                      CVE-2026-87461 CVE-2026-87462 CVE-2026-87463 CVE-2026-87464                      CVE-2026-87465 CVE-2026-87466 CVE-2026-87467 CVE-2026-87468                      CVE-2026-87469 CVE-2026-87470 CVE-2026-87471 CVE-2026-87472                      CVE-2026-87473 CVE-2026-87474 CVE-2026-87475 CVE-2026-87476                      CVE-2026-87477 CVE-2026-87478 CVE-2026-87479 CVE-2026-87480                      CVE-2026-87481 CVE-2026-87482 CVE-2026-87483 CVE-2026-87484                      CVE-2026-87485 CVE-2026-87486 CVE-2026-87487 CVE-2026-87488                      CVE-2026-87489 CVE-2026-87490 CVE-2026-87491 CVE-2026-87492                      CVE-2026-87493 CVE-2026-87494 CVE-2026-87495 CVE-2026-87496                      CVE-2026-87497 CVE-2026-87498 CVE-2026-87499 CVE-2026-87500                      CVE-2026-87501 CVE-2026-87502 CVE-2026-87503 CVE-2026-87504                      CVE-2026-87505 CVE-2026-87506 CVE-2026-87507 CVE-2026-87508                      CVE-2026-87509 CVE-2026-87510 CVE-2026-87511 CVE-2026-87512                      CVE-2026-87513 CVE-2026-87514 CVE-2026-87515 CVE-2026-87516                      CVE-2026-87517 CVE-2026-87518 CVE-2026-87519 CVE-2026-87520                      CVE-2026-87521 CVE-2026-87522 CVE-2026-87523 CVE-2026-87524                      CVE-2026-87525 CVE-2026-87526 CVE-2026-87527 CVE-2026-87528                      CVE-2026-87529 CVE-2026-87530 CVE-2026-87531 CVE-2026-87532                      CVE-2026-87533 CVE-2026-87534 CVE-2026-87535 CVE-2026-87536                      CVE-2026-87537 CVE-2026-87538 CVE-2026-87539 CVE-2026-87540                      CVE-2026-87541 CVE-2026-87542 CVE-2026-87543 CVE-2026-87544                      CVE-2026-87545 CVE-2026-87546 CVE-2026-87547 CVE-2026-87548                      CVE-2026-87549 CVE-2026-87550 CVE-2026-87551 CVE-2026-87552                      CVE-2026-87553 CVE-2026-87554 CVE-2026-87555 CVE-2026-87556                      CVE-2026-87557 CVE-2026-87558 CVE-2026-87559 CVE-2026-87560                      CVE-2026-87561 CVE-2026-87562 CVE-2026-87563 CVE-2026-87564                      CVE-2026-87565 CVE-2026-87566 CVE-2026-87567 CVE-2026-87568                      CVE-2026-87569 CVE-2026-87570 CVE-2026-87571 CVE-2026-87572                      CVE-2026-87573 CVE-2026-87574 CVE-2026-87575 CVE-2026-87576                      CVE-2026-87577 CVE-2026-87578 CVE-2026-87579 CVE-2026-87580                      CVE-2026-87581 CVE-2026-87582 CVE-2026-87583 CVE-2026-87584                      CVE-2026-87585 CVE-2026-87586 CVE-2026-87587 CVE-2026-87588                      CVE-2026-87589 CVE-2026-87590 CVE-2026-87591 CVE-2026-87592                      CVE-2026-87593 CVE-2026-87594 CVE-2026-87595 CVE-2026-87596                      CVE-2026-87597 CVE-2026-87598 CVE-2026-87599 CVE-2026-87600                      CVE-2026-87601 CVE-2026-87602 CVE-2026-87603 CVE-2026-87604                      CVE-2026-87605 CVE-2026-87606 CVE-2026-87607 CVE-2026-87608                      CVE-2026-87609 CVE-2026-87610 CVE-2026-87611 CVE-2026-87612                      CVE-2026-87613 CVE-2026-87614 CVE-2026-87615 CVE-2026-87616                      CVE-2026-87617 CVE-2026-87618 CVE-2026-87619 CVE-2026-87620                      CVE-2026-87621 CVE-2026-87622 CVE-2026-87623 CVE-2026-87624                      CVE-2026-87625 CVE-2026-87626 CVE-2026-87627 CVE-2026-87628                      CVE-2026-87629 CVE-2026-87630 CVE-2026-87631 CVE-2026-87632                      CVE-2026-87633 CVE-2026-87634 CVE-2026-87635 CVE-2026-87636                      CVE-2026-87637 CVE-2026-87638 CVE-2026-87639 CVE-2026-87640                      CVE-2026-87641 CVE-2026-87642 CVE-2026-87643 CVE-2026-87644                      CVE-2026-87645 CVE-2026-87646 CVE-2026-87647 CVE-2026-87648                      CVE-2026-87649 CVE-2026-87650 CVE-2026-87651 CVE-2026-87652                      CVE-2026-87653 CVE-2026-87654 CVE-2026-87655 CVE-2026-87656                      CVE-2026-87657 CVE-2026-87658 CVE-2026-91708 CVE-2026-91709                      CVE-2026-91710 CVE-2026-91711 CVE-2026-91712 CVE-2026-91713                      CVE-2026-91714 CVE-2026-91715 CVE-2026-91716 CVE-2026-91717                      CVE-2026-91718 CVE-2026-91719 CVE-2026-91720 CVE-2026-91721                      CVE-2026-91722 CVE-2026-91723 CVE-2026-91724 CVE-2026-91725                      CVE-2026-91726 CVE-2026-91727 CVE-2026-91728 CVE-2026-91729                      CVE-2026-91730 CVE-2026-91731 CVE-2026-91732 CVE-2026-91733                      CVE-2026-91734 CVE-2026-91735 CVE-2026-91736 CVE-2026-91737                      CVE-2026-91738 CVE-2026-91739 CVE-2026-91740 CVE-2026-91741                      CVE-2026-91742 CVE-2026-91743 CVE-2026-91744 CVE-2026-91745                      CVE-2026-91746 CVE-2026-91747 CVE-2026-91748 CVE-2026-91749

    Security issues were discovered in Chromium which could result     in the execution of arbitrary code, denial of service, or information     disclosure.

    For the stable distribution (trixie), these problems have been fixed in     version 153.0.8010.47-2~deb13u1.

    We recommend that you upgrade your chromium packages.

    For the detailed security status of chromium please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/chromium

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 153.0.8010.47. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026_09_stable-channel-update-for-desktop_0541751186 advisory.

  - Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially     execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)     (CVE-2026-91749)

  - Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who     had compromised the renderer process and leveraged social engineering to bypass web origin policy via a     crafted HTML page. (Chromium security severity: Medium) (CVE-2026-91732)

  - Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had     compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security     severity: High) (CVE-2026-91708)

  - Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to     execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-91709, CVE-2026-91715)

  - Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to     execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-91710)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 153.0.8010.47. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026_09_stable-channel-update-for-desktop_0541751186 advisory.

  - Use after free in Workers in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially     execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)     (CVE-2026-91749)

  - Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who     had compromised the renderer process and leveraged social engineering to bypass web origin policy via a     crafted HTML page. (Chromium security severity: Medium) (CVE-2026-91732)

  - Race condition in Network in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had     compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security     severity: High) (CVE-2026-91708)

  - Type confusion in ServiceWorker in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to     execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-91709, CVE-2026-91715)

  - Use after free in WebAppInstalls in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to     execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-91710)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
462680	Echo: chromium: security update to 153.0.8010.47-1	Tenable Cloud Security	Echo Local Security Checks	Local	medium
462680	Echo: chromium: security update to 153.0.8010.47-1	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
355136	Rocky Linux 9 [CIQ] Security Update: webkit2gtk3 / webkit2gtk3-debuginfo / webkit2gtk3-debugsource / etc Multiple Vulnerabilities (crlsa-2026_69098)	Nessus	Rocky Linux Local Security Checks	Local	critical
353337	AlmaLinux 9.6 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790805563)	Nessus	Alma Linux Local Security Checks	Local	high
353335	Rocky Linux 9.6 [TuxCare] Security Update: webkit2gtk3 / webkit2gtk3-devel / webkit2gtk3-jsc / etc Multiple Vulnerabilities (ALMALINUX9.6:CLSA-2026:1790805563)	Nessus	Rocky Linux Local Security Checks	Local	high
350085	Fedora 44 : webkitgtk (2026-40db9b80a2)	Nessus	Fedora Local Security Checks	Local	critical
349728	MiracleLinux 9 : webkit2gtk3-2.54.0-1.el9_8 (AXSA:2026-1904:08)	Nessus	Miracle Linux Local Security Checks	Local	critical
349622	Fedora 43 : chromium (2026-dd12c89e57)	Nessus	Fedora Local Security Checks	Local	high
349198	Linux Distros Unpatched Vulnerability : CVE-2026-91740	Nessus	Misc.	Local	medium
349114	Fedora 44 : chromium (2026-f910229c11)	Nessus	Fedora Local Security Checks	Local	high
349100	RockyLinux 9 : webkit2gtk3 (RLSA-2026:69098)	Nessus	Rocky Linux Local Security Checks	Local	critical
348734	AlmaLinux 9 : webkit2gtk3 (ALSA-2026:69098)	Nessus	Alma Linux Local Security Checks	Local	critical
348598	RHEL 9 : webkit2gtk3 (RHSA-2026:69098)	Nessus	Red Hat Local Security Checks	Local	critical
348392	Debian dla-4790 : chromium - security update	Nessus	Debian Local Security Checks	Local	critical
348240	Microsoft Edge (Chromium) < 153.0.4234.46 Multiple Vulnerabilities	Nessus	Windows	Local	high
346981	Debian dsa-6506 : chromium - security update	Nessus	Debian Local Security Checks	Local	critical
345979	Google Chrome < 153.0.8010.47 Multiple Vulnerabilities	Nessus	Windows	Local	high
345978	Google Chrome < 153.0.8010.47 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Local	high

Detections

Analytics

CVE-2026-91740

medium

Tenable Plugins

medium

medium

critical

high

high

critical

critical

high

medium

high

critical

critical

critical

critical

high

critical

high

high