Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a
    remote attacker leveraging social engineering to bypass system access restrictions via crafted network
    traffic. (Chromium security severity: Medium) (CVE-2026-93384)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21921-1 advisory.

    Changes in chromium:

    - Chromium 153.0.8010.52 (boo#1281123):
      * CVE-2026-93374: Use after free in Dawn
      * CVE-2026-93372: Buffer overflow in WebGL
      * CVE-2026-93375: Incorrect reference resolution in Tracing
      * CVE-2026-93382: Use after free in PDFium
      * CVE-2026-93387: Improper state validation in Skia
      * CVE-2026-93373: Use after free in Extensions
      * CVE-2026-93381: Buffer overflow in PDFium
      * CVE-2026-93379: Incorrect authorization in ORB
      * CVE-2026-93377: Type confusion in V8
      * CVE-2026-93380: Race condition in FileSystem
      * CVE-2026-93384: Server-side request forgery in Omnibox
      * CVE-2026-93383: Information leak in Permissions
      * CVE-2026-93376: Out of bounds read in DataTransfer
      * CVE-2026-93378: Missing authorization in Storage
      * CVE-2026-93385: Information leak in Paint
      * CVE-2026-93386: UI misrepresentation in WebAppInstalls

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-dd12c89e57 advisory.

    Update to 153.0.8010.52

      * CVE-2026-91708: Race condition in Network
      * CVE-2026-91709: Type confusion in ServiceWorker
      * CVE-2026-91710: Use after free in WebAppInstalls
      * CVE-2026-91711: Out of bounds write in ServiceWorker
      * CVE-2026-91712: Race condition in Extensions
      * CVE-2026-91713: Missing authorization in Browser
      * CVE-2026-91714: Observable discrepancy in Fonts
      * CVE-2026-91715: Type confusion in ServiceWorker
      * CVE-2026-91716: Use after free in Auth
      * CVE-2026-91717: Missing authorization in Android
      * CVE-2026-91718: Use after free in Core
      * CVE-2026-91719: Code injection in XML
      * CVE-2026-91720: Uninitialized resource in ANGLE
      * CVE-2026-91721: Use after free in Internals
      * CVE-2026-91722: Use after free in Input
      * CVE-2026-91723: Race condition in WebAppInstalls
      * CVE-2026-91724: Use after free in Input
      * CVE-2026-91725: Observable discrepancy in CSS
      * CVE-2026-91726: Out of bounds read in WebGL
      * CVE-2026-91727: Incorrect reference resolution in Extensions
      * CVE-2026-91728: Integer overflow in V8
      * CVE-2026-91729: Use after free in DigitalCredentials
      * CVE-2026-91730: Incomplete cleanup in GetUserMedia
      * CVE-2026-91731: Type confusion in Compositing
      * CVE-2026-91732: Missing authorization in AppManifest
      * CVE-2026-91733: Improper state validation in Skia
      * CVE-2026-91734: Incorrect authorization in Core
      * CVE-2026-91735: Incorrect authorization in WebUI
      * CVE-2026-91736: Use after free in DOM
      * CVE-2026-91737: Use after free in PDF
      * CVE-2026-91738: Improper input validation in ANGLE
      * CVE-2026-91739: Missing authorization in Transactions Platform
      * CVE-2026-91740: Uninitialized resource in Skia
      * CVE-2026-91741: Type confusion in CacheStorage
      * CVE-2026-91742: Confused deputy in PriceTracking
      * CVE-2026-91743: Race condition in Core
      * CVE-2026-91744: Race condition in PlatformIntegration
      * CVE-2026-91745: Use after free in V8
      * CVE-2026-91746: Integer overflow in Compositing
      * CVE-2026-91747: Use after free in Skia
      * CVE-2026-91748: Race condition in Extensions
      * CVE-2026-91749: Use after free in Workers
      * CVE-2026-93372: Buffer overflow in WebGL
      * CVE-2026-93373: Use after free in Extensions
      * CVE-2026-93374: Use after free in Dawn
      * CVE-2026-93375: Incorrect reference resolution in Tracing
      * CVE-2026-93376: Out of bounds read in DataTransfer
      * CVE-2026-93377: Type confusion in V8
      * CVE-2026-93378: Missing authorization in Storage
      * CVE-2026-93379: Incorrect authorization in ORB
      * CVE-2026-93380: Race condition in FileSystem
      * CVE-2026-93381: Buffer overflow in PDFium
      * CVE-2026-93382: Use after free in PDFium
      * CVE-2026-93383: Information leak in Permissions
      * CVE-2026-93384: Server-side request forgery in Omnibox
      * CVE-2026-93385: Information leak in Paint
      * CVE-2026-93386: UI misrepresentation in WebAppInstalls
      * CVE-2026-93387: Improper state validation in Skia


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f910229c11 advisory.

    Update to 153.0.8010.52

      * CVE-2026-91708: Race condition in Network
      * CVE-2026-91709: Type confusion in ServiceWorker
      * CVE-2026-91710: Use after free in WebAppInstalls
      * CVE-2026-91711: Out of bounds write in ServiceWorker
      * CVE-2026-91712: Race condition in Extensions
      * CVE-2026-91713: Missing authorization in Browser
      * CVE-2026-91714: Observable discrepancy in Fonts
      * CVE-2026-91715: Type confusion in ServiceWorker
      * CVE-2026-91716: Use after free in Auth
      * CVE-2026-91717: Missing authorization in Android
      * CVE-2026-91718: Use after free in Core
      * CVE-2026-91719: Code injection in XML
      * CVE-2026-91720: Uninitialized resource in ANGLE
      * CVE-2026-91721: Use after free in Internals
      * CVE-2026-91722: Use after free in Input
      * CVE-2026-91723: Race condition in WebAppInstalls
      * CVE-2026-91724: Use after free in Input
      * CVE-2026-91725: Observable discrepancy in CSS
      * CVE-2026-91726: Out of bounds read in WebGL
      * CVE-2026-91727: Incorrect reference resolution in Extensions
      * CVE-2026-91728: Integer overflow in V8
      * CVE-2026-91729: Use after free in DigitalCredentials
      * CVE-2026-91730: Incomplete cleanup in GetUserMedia
      * CVE-2026-91731: Type confusion in Compositing
      * CVE-2026-91732: Missing authorization in AppManifest
      * CVE-2026-91733: Improper state validation in Skia
      * CVE-2026-91734: Incorrect authorization in Core
      * CVE-2026-91735: Incorrect authorization in WebUI
      * CVE-2026-91736: Use after free in DOM
      * CVE-2026-91737: Use after free in PDF
      * CVE-2026-91738: Improper input validation in ANGLE
      * CVE-2026-91739: Missing authorization in Transactions Platform
      * CVE-2026-91740: Uninitialized resource in Skia
      * CVE-2026-91741: Type confusion in CacheStorage
      * CVE-2026-91742: Confused deputy in PriceTracking
      * CVE-2026-91743: Race condition in Core
      * CVE-2026-91744: Race condition in PlatformIntegration
      * CVE-2026-91745: Use after free in V8
      * CVE-2026-91746: Integer overflow in Compositing
      * CVE-2026-91747: Use after free in Skia
      * CVE-2026-91748: Race condition in Extensions
      * CVE-2026-91749: Use after free in Workers
      * CVE-2026-93372: Buffer overflow in WebGL
      * CVE-2026-93373: Use after free in Extensions
      * CVE-2026-93374: Use after free in Dawn
      * CVE-2026-93375: Incorrect reference resolution in Tracing
      * CVE-2026-93376: Out of bounds read in DataTransfer
      * CVE-2026-93377: Type confusion in V8
      * CVE-2026-93378: Missing authorization in Storage
      * CVE-2026-93379: Incorrect authorization in ORB
      * CVE-2026-93380: Race condition in FileSystem
      * CVE-2026-93381: Buffer overflow in PDFium
      * CVE-2026-93382: Use after free in PDFium
      * CVE-2026-93383: Information leak in Permissions
      * CVE-2026-93384: Server-side request forgery in Omnibox
      * CVE-2026-93385: Information leak in Paint
      * CVE-2026-93386: UI misrepresentation in WebAppInstalls
      * CVE-2026-93387: Improper state validation in Skia


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6508 advisory.

    - -------------------------------------------------------------------------     Debian Security Advisory DSA-6508-1                   security@debian.org     https://www.debian.org/security/                           Andres Salomon     September 19, 2026                    https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package        : chromium     CVE ID         : CVE-2026-93372 CVE-2026-93373 CVE-2026-93374 CVE-2026-93375                      CVE-2026-93376 CVE-2026-93377 CVE-2026-93378 CVE-2026-93379                      CVE-2026-93380 CVE-2026-93381 CVE-2026-93382 CVE-2026-93383                      CVE-2026-93384 CVE-2026-93385 CVE-2026-93386 CVE-2026-93387

    Security issues were discovered in Chromium which could result     in the execution of arbitrary code, denial of service, or information     disclosure.

    For the stable distribution (trixie), these problems have been fixed in     version 153.0.8010.52-1~deb13u1.

    We recommend that you upgrade your chromium packages.

    For the detailed security status of chromium please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/chromium

    Further information about Debian Security Advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4790 advisory.

    - -------------------------------------------------------------------------     Debian LTS Advisory DLA-4790-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/               Emilio Pozuelo Monfort     September 21, 2026                            https://wiki.debian.org/LTS
    - -------------------------------------------------------------------------

    Package        : chromium     Version        : 153.0.8010.52-1~deb12u1     CVE ID         : CVE-2026-87429 CVE-2026-87430 CVE-2026-87431 CVE-2026-87432                      CVE-2026-87433 CVE-2026-87434 CVE-2026-87435 CVE-2026-87436                      CVE-2026-87437 CVE-2026-87438 CVE-2026-87439 CVE-2026-87440                      CVE-2026-87441 CVE-2026-87442 CVE-2026-87443 CVE-2026-87444                      CVE-2026-87445 CVE-2026-87446 CVE-2026-87447 CVE-2026-87448                      CVE-2026-87449 CVE-2026-87450 CVE-2026-87451 CVE-2026-87452                      CVE-2026-87453 CVE-2026-87454 CVE-2026-87455 CVE-2026-87456                      CVE-2026-87457 CVE-2026-87458 CVE-2026-87459 CVE-2026-87460                      CVE-2026-87461 CVE-2026-87462 CVE-2026-87463 CVE-2026-87464                      CVE-2026-87465 CVE-2026-87466 CVE-2026-87467 CVE-2026-87468                      CVE-2026-87469 CVE-2026-87470 CVE-2026-87471 CVE-2026-87472                      CVE-2026-87473 CVE-2026-87474 CVE-2026-87475 CVE-2026-87476                      CVE-2026-87477 CVE-2026-87478 CVE-2026-87479 CVE-2026-87480                      CVE-2026-87481 CVE-2026-87482 CVE-2026-87483 CVE-2026-87484                      CVE-2026-87485 CVE-2026-87486 CVE-2026-87487 CVE-2026-87488                      CVE-2026-87489 CVE-2026-87490 CVE-2026-87491 CVE-2026-87492                      CVE-2026-87493 CVE-2026-87494 CVE-2026-87495 CVE-2026-87496                      CVE-2026-87497 CVE-2026-87498 CVE-2026-87499 CVE-2026-87500                      CVE-2026-87501 CVE-2026-87502 CVE-2026-87503 CVE-2026-87504                      CVE-2026-87505 CVE-2026-87506 CVE-2026-87507 CVE-2026-87508                      CVE-2026-87509 CVE-2026-87510 CVE-2026-87511 CVE-2026-87512                      CVE-2026-87513 CVE-2026-87514 CVE-2026-87515 CVE-2026-87516                      CVE-2026-87517 CVE-2026-87518 CVE-2026-87519 CVE-2026-87520                      CVE-2026-87521 CVE-2026-87522 CVE-2026-87523 CVE-2026-87524                      CVE-2026-87525 CVE-2026-87526 CVE-2026-87527 CVE-2026-87528                      CVE-2026-87529 CVE-2026-87530 CVE-2026-87531 CVE-2026-87532                      CVE-2026-87533 CVE-2026-87534 CVE-2026-87535 CVE-2026-87536                      CVE-2026-87537 CVE-2026-87538 CVE-2026-87539 CVE-2026-87540                      CVE-2026-87541 CVE-2026-87542 CVE-2026-87543 CVE-2026-87544                      CVE-2026-87545 CVE-2026-87546 CVE-2026-87547 CVE-2026-87548                      CVE-2026-87549 CVE-2026-87550 CVE-2026-87551 CVE-2026-87552                      CVE-2026-87553 CVE-2026-87554 CVE-2026-87555 CVE-2026-87556                      CVE-2026-87557 CVE-2026-87558 CVE-2026-87559 CVE-2026-87560                      CVE-2026-87561 CVE-2026-87562 CVE-2026-87563 CVE-2026-87564                      CVE-2026-87565 CVE-2026-87566 CVE-2026-87567 CVE-2026-87568                      CVE-2026-87569 CVE-2026-87570 CVE-2026-87571 CVE-2026-87572                      CVE-2026-87573 CVE-2026-87574 CVE-2026-87575 CVE-2026-87576                      CVE-2026-87577 CVE-2026-87578 CVE-2026-87579 CVE-2026-87580                      CVE-2026-87581 CVE-2026-87582 CVE-2026-87583 CVE-2026-87584                      CVE-2026-87585 CVE-2026-87586 CVE-2026-87587 CVE-2026-87588                      CVE-2026-87589 CVE-2026-87590 CVE-2026-87591 CVE-2026-87592                      CVE-2026-87593 CVE-2026-87594 CVE-2026-87595 CVE-2026-87596                      CVE-2026-87597 CVE-2026-87598 CVE-2026-87599 CVE-2026-87600                      CVE-2026-87601 CVE-2026-87602 CVE-2026-87603 CVE-2026-87604                      CVE-2026-87605 CVE-2026-87606 CVE-2026-87607 CVE-2026-87608                      CVE-2026-87609 CVE-2026-87610 CVE-2026-87611 CVE-2026-87612                      CVE-2026-87613 CVE-2026-87614 CVE-2026-87615 CVE-2026-87616                      CVE-2026-87617 CVE-2026-87618 CVE-2026-87619 CVE-2026-87620                      CVE-2026-87621 CVE-2026-87622 CVE-2026-87623 CVE-2026-87624                      CVE-2026-87625 CVE-2026-87626 CVE-2026-87627 CVE-2026-87628                      CVE-2026-87629 CVE-2026-87630 CVE-2026-87631 CVE-2026-87632                      CVE-2026-87633 CVE-2026-87634 CVE-2026-87635 CVE-2026-87636                      CVE-2026-87637 CVE-2026-87638 CVE-2026-87639 CVE-2026-87640                      CVE-2026-87641 CVE-2026-87642 CVE-2026-87643 CVE-2026-87644                      CVE-2026-87645 CVE-2026-87646 CVE-2026-87647 CVE-2026-87648                      CVE-2026-87649 CVE-2026-87650 CVE-2026-87651 CVE-2026-87652                      CVE-2026-87653 CVE-2026-87654 CVE-2026-87655 CVE-2026-87656                      CVE-2026-87657 CVE-2026-87658 CVE-2026-91708 CVE-2026-91709                      CVE-2026-91710 CVE-2026-91711 CVE-2026-91712 CVE-2026-91713                      CVE-2026-91714 CVE-2026-91715 CVE-2026-91716 CVE-2026-91717                      CVE-2026-91718 CVE-2026-91719 CVE-2026-91720 CVE-2026-91721                      CVE-2026-91722 CVE-2026-91723 CVE-2026-91724 CVE-2026-91725                      CVE-2026-91726 CVE-2026-91727 CVE-2026-91728 CVE-2026-91729                      CVE-2026-91730 CVE-2026-91731 CVE-2026-91732 CVE-2026-91733                      CVE-2026-91734 CVE-2026-91735 CVE-2026-91736 CVE-2026-91737                      CVE-2026-91738 CVE-2026-91739 CVE-2026-91740 CVE-2026-91741                      CVE-2026-91742 CVE-2026-91743 CVE-2026-91744 CVE-2026-91745                      CVE-2026-91746 CVE-2026-91747 CVE-2026-91748 CVE-2026-91749                      CVE-2026-93372 CVE-2026-93373 CVE-2026-93374 CVE-2026-93375                      CVE-2026-93376 CVE-2026-93377 CVE-2026-93378 CVE-2026-93379                      CVE-2026-93380 CVE-2026-93381 CVE-2026-93382 CVE-2026-93383                      CVE-2026-93384 CVE-2026-93385 CVE-2026-93386 CVE-2026-93387

    Security issues were discovered in Chromium which could result     in the execution of arbitrary code, denial of service, or information     disclosure.

    For Debian 12 bookworm, these problems have been fixed in version     153.0.8010.52-1~deb12u1.

    We recommend that you upgrade your chromium packages.

    For the detailed security status of chromium please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/chromium

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote Windows host is prior to 153.0.8010.52. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026_09_stable-channel-update-for-desktop_0194356994 advisory.

  - Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute     arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-93382)

  - Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to     potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security     severity: Critical) (CVE-2026-93374)

  - Buffer overflow in WebGL in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker     to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity:
    Critical) (CVE-2026-93372)

  - Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute     arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)     (CVE-2026-93373)

  - Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a     local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium     security severity: High) (CVE-2026-93375)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Google Chrome installed on the remote macOS host is prior to 153.0.8010.52. It is, therefore, affected by multiple vulnerabilities as referenced in the 2026_09_stable-channel-update-for-desktop_0194356994 advisory.

  - Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute     arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)     (CVE-2026-93382)

  - Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to     potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security     severity: Critical) (CVE-2026-93374)

  - Buffer overflow in WebGL in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker     to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity:
    Critical) (CVE-2026-93372)

  - Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute     arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: High)     (CVE-2026-93373)

  - Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a     local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium     security severity: High) (CVE-2026-93375)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
463038	Echo: chromium: security update to 153.0.8010.52	Tenable Cloud Security	Echo Local Security Checks	Local	low
463038	Echo: chromium: security update to 153.0.8010.52	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	low
350159	openSUSE 16 Security Update : chromium (openSUSE-SU-2026:21921-1)	Nessus	SuSE Local Security Checks	Local	critical
349622	Fedora 43 : chromium (2026-dd12c89e57)	Nessus	Fedora Local Security Checks	Local	high
349114	Fedora 44 : chromium (2026-f910229c11)	Nessus	Fedora Local Security Checks	Local	high
348573	Debian dsa-6508 : chromium - security update	Nessus	Debian Local Security Checks	Local	critical
348392	Debian dla-4790 : chromium - security update	Nessus	Debian Local Security Checks	Local	critical
346979	Google Chrome < 153.0.8010.52 Multiple Vulnerabilities	Nessus	Windows	Local	critical
346978	Google Chrome < 153.0.8010.52 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	Local	critical

Detections

Analytics

CVE-2026-93384

low

Tenable Plugins

low

low

critical

high

high

critical

critical

critical

critical