The version of Google Chrome installed on the remote macOS host is prior to 66.0.3359.117. It is, therefore, affected by multiple vulnerabilities as referenced in the 2018_04_stable-channel-update-for-desktop advisory.

  - Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117     allowed a local attacker to execute arbitrary code via an executable file. (CVE-2018-6084)

  - The implementation of the Page.downloadBehavior backend unconditionally marked downloaded files as safe,     regardless of file type in Google Chrome prior to 66.0.3359.117 allowed an attacker who convinced a user     to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page and user     interaction. (CVE-2018-6152)

  - Re-entry of a destructor in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote     attacker to execute arbitrary code via a crafted HTML page. (CVE-2018-6085)

  - A double-eviction in the Incognito mode cache that lead to a user-after-free in Networking Disk Cache in     Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted     HTML page. (CVE-2018-6086)

  - A use-after-free in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to     execute arbitrary code inside a sandbox via a crafted HTML page. (CVE-2018-6087)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Google Chrome Releases reports :

62 security fixes in this release :

- [826626] Critical CVE-2018-6085: Use after free in Disk Cache.
Reported by Ned Williamson on 2018-03-28

- [827492] Critical CVE-2018-6086: Use after free in Disk Cache.
Reported by Ned Williamson on 2018-03-30

- [813876] High CVE-2018-6087: Use after free in WebAssembly. Reported by Anonymous on 2018-02-20

- [822091] High CVE-2018-6088: Use after free in PDFium. Reported by Anonymous on 2018-03-15

- [808838] High CVE-2018-6089: Same origin policy bypass in Service Worker. Reported by Rob Wu on 2018-02-04

- [820913] High CVE-2018-6090: Heap buffer overflow in Skia. Reported by ZhanJia Song on 2018-03-12

- [771933] High CVE-2018-6091: Incorrect handling of plug-ins by Service Worker. Reported by Jun Kokatsu (@shhnjk) on 2017-10-05

- [819869] High CVE-2018-6092: Integer overflow in WebAssembly.
Reported by Natalie Silvanovich of Google Project Zero on 2018-03-08

- [780435] Medium CVE-2018-6093: Same origin bypass in Service Worker.
Reported by Jun Kokatsu (@shhnjk) on 2017-11-01

- [633030] Medium CVE-2018-6094: Exploit hardening regression in Oilpan. Reported by Chris Rohlf on 2016-08-01

- [637098] Medium CVE-2018-6095: Lack of meaningful user interaction requirement before file upload. Reported by Abdulrahman Alqabandi (@qab) on 2016-08-11

- [776418] Medium CVE-2018-6096: Fullscreen UI spoof. Reported by WenXu Wu of Tencent's Xuanwu Lab on 2017-10-19

- [806162] Medium CVE-2018-6097: Fullscreen UI spoof. Reported by xisigr of Tencent's Xuanwu Lab on 2018-01-26

- [798892] Medium CVE-2018-6098: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-01-03

- [808825] Medium CVE-2018-6099: CORS bypass in ServiceWorker.
Reported by Jun Kokatsu (@shhnjk) on 2018-02-03

- [811117] Medium CVE-2018-6100: URL spoof in Omnibox. Reported by Lnyas Zhang on 2018-02-11

- [813540] Medium CVE-2018-6101: Insufficient protection of remote debugging prototol in DevTools . Reported by Rob Wu on 2018-02-19

- [813814] Medium CVE-2018-6102: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-20

- [816033] Medium CVE-2018-6103: UI spoof in Permissions. Reported by Khalil Zhani on 2018-02-24

- [820068] Medium CVE-2018-6104: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-03-08

- [803571] Medium CVE-2018-6105: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-01-18

- [805729] Medium CVE-2018-6106: Incorrect handling of promises in V8.
Reported by lokihardt of Google Project Zero on 2018-01-25

- [808316] Medium CVE-2018-6107: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-02

- [816769] Medium CVE-2018-6108: URL spoof in Omnibox. Reported by Khalil Zhani on 2018-02-27

- [710190] Low CVE-2018-6109: Incorrect handling of files by FileAPI.
Reported by Dominik Weber (@DoWeb_) on 2017-04-10

- [777737] Low CVE-2018-6110: Incorrect handling of plaintext files via file:// . Reported by Wenxiang Qian (aka blastxiang) on 2017-10-24

- [780694] Low CVE-2018-6111: Heap-use-after-free in DevTools.
Reported by Khalil Zhani on 2017-11-02

- [798096] Low CVE-2018-6112: Incorrect URL handling in DevTools.
Reported by Rob Wu on 2017-12-29

- [805900] Low CVE-2018-6113: URL spoof in Navigation. Reported by Khalil Zhani on 2018-01-25

- [811691] Low CVE-2018-6114: CSP bypass. Reported by Lnyas Zhang on 2018-02-13

- [819809] Low CVE-2018-6115: SmartScreen bypass in downloads.
Reported by James Feher on 2018-03-07

- [822266] Low CVE-2018-6116: Incorrect low memory handling in WebAssembly. Reported by Jin from Chengdu Security Response Center of Qihoo 360 Technology Co. Ltd. on 2018-03-15

- [822465] Low CVE-2018-6117: Confusing autofill settings. Reported by Spencer Dailey on 2018-03-15

- [822424] Low CVE-2018-6084: Incorrect use of Distributed Objects in Google Software Updater on MacOS. Reported by Ian Beer of Google Project Zero on 2018-03-15

The version of Google Chrome installed on the remote Windows host is prior to 66.0.3359.117. It is, therefore, affected by multiple vulnerabilities as referenced in the 2018_04_stable-channel-update-for-desktop advisory.

  - Insufficiently sanitized distributed objects in Updater in Google Chrome on macOS prior to 66.0.3359.117     allowed a local attacker to execute arbitrary code via an executable file. (CVE-2018-6084)

  - The implementation of the Page.downloadBehavior backend unconditionally marked downloaded files as safe,     regardless of file type in Google Chrome prior to 66.0.3359.117 allowed an attacker who convinced a user     to install a malicious extension to potentially perform a sandbox escape via a crafted HTML page and user     interaction. (CVE-2018-6152)

  - Re-entry of a destructor in Networking Disk Cache in Google Chrome prior to 66.0.3359.117 allowed a remote     attacker to execute arbitrary code via a crafted HTML page. (CVE-2018-6085)

  - A double-eviction in the Incognito mode cache that lead to a user-after-free in Networking Disk Cache in     Google Chrome prior to 66.0.3359.117 allowed a remote attacker to execute arbitrary code via a crafted     HTML page. (CVE-2018-6086)

  - A use-after-free in WebAssembly in Google Chrome prior to 66.0.3359.117 allowed a remote attacker to     execute arbitrary code inside a sandbox via a crafted HTML page. (CVE-2018-6087)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
109396	Google Chrome < 66.0.3359.117 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	4/27/2018	11/24/2025	critical
109330	FreeBSD : chromium -- vulnerability (36ff7a74-47b1-11e8-a7d6-54e1ad544088)	Nessus	FreeBSD Local Security Checks	4/25/2018	10/24/2024	high
109395	Google Chrome < 66.0.3359.117 Multiple Vulnerabilities	Nessus	Windows	4/27/2018	11/24/2025	critical

Detections

Analytics

Plugins Search

critical

high

critical