The version of Microsoft Edge installed on the remote Windows host is prior to 135.0.3179.54. It is, therefore, affected by multiple vulnerabilities as referenced in the April 3, 2025 advisory.

  - Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an     unauthorized attacker to execute code over a network. (CVE-2025-25000)

  - Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Edge     (Chromium-based) allows an unauthorized attacker to perform spoofing over a network. (CVE-2025-25001)

  - Use after free in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a     network. (CVE-2025-29815)

  - Use after free in Site Isolation in Google Chrome prior to 135.0.7049.84 allowed a remote attacker to     potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)     (CVE-2025-3066)

  - Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 135.0.7049.52 allowed a     remote attacker who convinced a user to engage in specific UI gestures to perform privilege escalation via     a crafted app. (Chromium security severity: Medium) (CVE-2025-3067)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Microsoft Edge (Chromium) < 135.0.3179.54 Multiple Vulnerabilities

high Nessus Plugin ID 233872

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.4 Apr 23, 2025, 4:57 AM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202504230457
Version 1.3 Apr 17, 2025, 10:25 AM IAVM reference Plugin Feed: 202504171025
Version 1.2 Apr 11, 2025, 8:06 PM Plugin metadata (Added IAVM info) Plugin Feed: 202504112006
Version 1.1 Apr 4, 2025, 9:01 PM New Plugin Feed: 202504042101