Detections
Analytics

Fedora 44 : chromium (2026-885a3f8c70)

critical Nessus Plugin ID 315114

Synopsis

The remote Fedora host is missing one or more security updates.

Description

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-885a3f8c70 advisory.

 Update to 148.0.7778.167

 * CVE-2026-8509: Heap buffer overflow in WebML
 * CVE-2026-8510: Integer overflow in Skia
 * CVE-2026-8511: Use after free in UI
 * CVE-2026-8512: Use after free in FileSystem
 * CVE-2026-8513: Use after free in Input
 * CVE-2026-8514: Use after free in Aura
 * CVE-2026-8515: Use after free in HID
 * CVE-2026-8516: Insufficient validation of untrusted input in DataTransfer
 * CVE-2026-8517: Object lifecycle issue in WebShare
 * CVE-2026-8518: Use after free in Blink
 * CVE-2026-8519: Integer overflow in ANGLE
 * CVE-2026-8520: Race in Payments
 * CVE-2026-8521: Use after free in Tab Groups
 * CVE-2026-8522: Use after free in Downloads
 * CVE-2026-8523: Use after free in Mojo
 * CVE-2026-8558: Out of bounds write in Fonts
 * CVE-2026-8524: Out of bounds write in WebAudio
 * CVE-2026-8525: Heap buffer overflow in ANGLE
 * CVE-2026-8526: Out of bounds write in WebRTC
 * CVE-2026-8527: Insufficient validation of untrusted input in Downloads
 * CVE-2026-8528: Insufficient validation of untrusted input in SiteIsolation
 * CVE-2026-8529: Heap buffer overflow in Codecs
 * CVE-2026-8530: Use after free in Network
 * CVE-2026-8531: Heap buffer overflow in WebML
 * CVE-2026-8532: Integer overflow in XML
 * CVE-2026-8533: Use after free in Accessibility
 * CVE-2026-8534: Integer overflow in GPU
 * CVE-2026-8535: Out of bounds read in Media
 * CVE-2026-8536: Insufficient validation of untrusted input in ReadingMode
 * CVE-2026-8537: Insufficient policy enforcement in ViewTransitions
 * CVE-2026-8538: Insufficient validation of untrusted input in GPU
 * CVE-2026-8539: Script injection in SanitizerAPI
 * CVE-2026-8540: Type Confusion in V8
 * CVE-2026-8541: Out of bounds read in UI
 * CVE-2026-8542: Use after free in Core
 * CVE-2026-8543: Out of bounds read in FileSystem
 * CVE-2026-8544: Use after free in Media
 * CVE-2026-8545: Object corruption in Compositing
 * CVE-2026-8546: Out of bounds read in GPU
 * CVE-2026-8547: Insufficient policy enforcement in Passwords
 * CVE-2026-8548: Out of bounds write in Media
 * CVE-2026-8549: Use after free in Media
 * CVE-2026-8550: Use after free in Google Lens
 * CVE-2026-8551: Use after free in Downloads
 * CVE-2026-8552: Heap buffer overflow in GPU
 * CVE-2026-8553: Use after free in GPU
 * CVE-2026-8554: Type Confusion in ANGLE
 * CVE-2026-8555: Use after free in GTK
 * CVE-2026-8556: Inappropriate implementation in ANGLE
 * CVE-2026-8557: Use after free in Accessibility
 * CVE-2026-8559: Integer overflow in Internationalization
 * CVE-2026-8560: Heap buffer overflow in SwiftShader
 * CVE-2026-8561: Incorrect security UI in Fullscreen
 * CVE-2026-8562: Side-channel information leakage in Navigation
 * CVE-2026-8563: Insufficient policy enforcement in IFrame Sandbox
 * CVE-2026-8564: Incorrect security UI in Downloads
 * CVE-2026-8565: Inappropriate implementation in Downloads
 * CVE-2026-8566: Insufficient policy enforcement in Payments
 * CVE-2026-8567: Integer overflow in ANGLE
 * CVE-2026-8568: Insufficient policy enforcement in AI
 * CVE-2026-8569: Out of bounds write in Codecs
 * CVE-2026-8570: Type Confusion in V8
 * CVE-2026-8571: Insufficient policy enforcement in GPU
 * CVE-2026-8572: Insufficient policy enforcement in Network
 * CVE-2026-8573: Integer overflow in Codecs
 * CVE-2026-8574: Use after free in Core
 * CVE-2026-8575: Use after free in UI
 * CVE-2026-8576: Inappropriate implementation in CORS
 * CVE-2026-8577: Integer overflow in Fonts
 * CVE-2026-8578: Out of bounds read in GPU
 * CVE-2026-8579: Insufficient validation of untrusted input in Skia
 * CVE-2026-8580: Use after free in Mojo
 * CVE-2026-8581: Use after free in GPU
 * CVE-2026-8582: Object lifecycle issue in Dawn
 * CVE-2026-8583: Insufficient policy enforcement in WebXR
 * CVE-2026-8584: Inappropriate implementation in Views
 * CVE-2026-8585: Inappropriate implementation in Media
 * CVE-2026-8586: Inappropriate implementation in Chromoting
 * CVE-2026-8587: Use after free in Extensions


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Update the affected chromium package.

See Also

https://bodhi.fedoraproject.org/updates/FEDORA-2026-885a3f8c70

Plugin Details

Severity: Critical

ID: 315114

File Name: fedora_2026-885a3f8c70.nasl

Version: 1.1

Type: Local

Agent: unix

Published: 5/17/2026

Updated: 5/17/2026

Supported Sensors: Continuous Assessment, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.4

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-7910

CVSS v3

Risk Factor: Critical

Base Score: 9.6

Temporal Score: 8.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:fedoraproject:fedora:44, p-cpe:/a:fedoraproject:fedora:chromium

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list

Exploit Ease: No known exploits are available

Patch Publication Date: 5/16/2026

Vulnerability Publication Date: 5/5/2026

Reference Information

CVE: CVE-2026-7896, CVE-2026-7897, CVE-2026-7898, CVE-2026-7899, CVE-2026-7900, CVE-2026-7901, CVE-2026-7902, CVE-2026-7903, CVE-2026-7904, CVE-2026-7905, CVE-2026-7906, CVE-2026-7907, CVE-2026-7908, CVE-2026-7909, CVE-2026-7910, CVE-2026-8509, CVE-2026-8510, CVE-2026-8511, CVE-2026-8512, CVE-2026-8513, CVE-2026-8514, CVE-2026-8515, CVE-2026-8516, CVE-2026-8517, CVE-2026-8518, CVE-2026-8519, CVE-2026-8520, CVE-2026-8521, CVE-2026-8522, CVE-2026-8523, CVE-2026-8524, CVE-2026-8525, CVE-2026-8526, CVE-2026-8527, CVE-2026-8528, CVE-2026-8529, CVE-2026-8530, CVE-2026-8531, CVE-2026-8532, CVE-2026-8533, CVE-2026-8534, CVE-2026-8535, CVE-2026-8536, CVE-2026-8537, CVE-2026-8538, CVE-2026-8539, CVE-2026-8540, CVE-2026-8541, CVE-2026-8542, CVE-2026-8543, CVE-2026-8544, CVE-2026-8545, CVE-2026-8546, CVE-2026-8547, CVE-2026-8548, CVE-2026-8549, CVE-2026-8550, CVE-2026-8551, CVE-2026-8552, CVE-2026-8553, CVE-2026-8554, CVE-2026-8555, CVE-2026-8556, CVE-2026-8557, CVE-2026-8558, CVE-2026-8559, CVE-2026-8560, CVE-2026-8561, CVE-2026-8562, CVE-2026-8563, CVE-2026-8564, CVE-2026-8565, CVE-2026-8566, CVE-2026-8567, CVE-2026-8568, CVE-2026-8569, CVE-2026-8570, CVE-2026-8571, CVE-2026-8572, CVE-2026-8573, CVE-2026-8574, CVE-2026-8575, CVE-2026-8576, CVE-2026-8577, CVE-2026-8578, CVE-2026-8579, CVE-2026-8580, CVE-2026-8581, CVE-2026-8582, CVE-2026-8583, CVE-2026-8584, CVE-2026-8585, CVE-2026-8586, CVE-2026-8587