The version of Microsoft Edge installed on the remote Windows host is prior to 149.0.4022.98. It is, therefore, affected by multiple vulnerabilities as referenced in the June 26, 2026 advisory.

  - Inappropriate implementation in Autofill in Google Chrome prior to 149.0.7827.197 allowed a remote     attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
    (Chromium security severity: High) (CVE-2026-13022)

  - Inappropriate implementation in DeviceBoundSessionCredentials in Google Chrome prior to 149.0.7827.197     allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security     severity: High) (CVE-2026-13021)

  - Uninitialized Use in GPU in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had     compromised the renderer process to obtain potentially sensitive information from process memory via a     crafted HTML page. (Chromium security severity: High) (CVE-2026-13023)

  - Insufficient validation of untrusted input in Navigation in Google Chrome prior to 149.0.7827.197 allowed     a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML     page. (Chromium security severity: High) (CVE-2026-13024)

  - Race in DevTools in Google Chrome prior to 149.0.7827.197 allowed a remote attacker who had compromised     the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security     severity: High) (CVE-2026-13025)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Microsoft Edge (Chromium) < 149.0.4022.98 Multiple Vulnerabilities

medium Nessus Plugin ID 323230

Version 1.3

Version 1.2

Version 1.1

Version 1.3 Jul 25, 2026, 1:54 AM CVE (set "CVE" coverage to "CVE-2026-13021,CVE-2026-13022,CVE-2026-13023,CVE-2026-13024,CVE-2026-13025,CVE-2026-13026,CVE-2026-13027,CVE-2026-13029,CVE-2026-13031,CVE-2026-13033,CVE-2026-13034,CVE-2026-13035,CVE-2026-13036,CVE-2026-13038") Plugin metadata Plugin Feed: 202607250154
Version 1.2 Jun 30, 2026, 5:42 PM IAVM reference STIG Severity (set to "I") Plugin Feed: 202606301742
Version 1.1 Jun 27, 2026, 1:18 PM New Plugin Feed: 202606271318