Google Chrome < 149.0.7827.102 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(319881);
  script_version("1.5");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/24");

  script_cve_id(
    "CVE-2026-11628",
    "CVE-2026-11629",
    "CVE-2026-11630",
    "CVE-2026-11631",
    "CVE-2026-11632",
    "CVE-2026-11633",
    "CVE-2026-11634",
    "CVE-2026-11635",
    "CVE-2026-11636",
    "CVE-2026-11637",
    "CVE-2026-11638",
    "CVE-2026-11639",
    "CVE-2026-11640",
    "CVE-2026-11641",
    "CVE-2026-11642",
    "CVE-2026-11643",
    "CVE-2026-11644",
    "CVE-2026-11645",
    "CVE-2026-11646",
    "CVE-2026-11647",
    "CVE-2026-11648",
    "CVE-2026-11649",
    "CVE-2026-11650",
    "CVE-2026-11651",
    "CVE-2026-11652",
    "CVE-2026-11653",
    "CVE-2026-11654",
    "CVE-2026-11655",
    "CVE-2026-11656",
    "CVE-2026-11657",
    "CVE-2026-11658",
    "CVE-2026-11659",
    "CVE-2026-11660",
    "CVE-2026-11661",
    "CVE-2026-11662",
    "CVE-2026-11663",
    "CVE-2026-11664",
    "CVE-2026-11665",
    "CVE-2026-11666",
    "CVE-2026-11667",
    "CVE-2026-11668",
    "CVE-2026-11669",
    "CVE-2026-11670",
    "CVE-2026-11671",
    "CVE-2026-11672",
    "CVE-2026-11673",
    "CVE-2026-11674",
    "CVE-2026-11675",
    "CVE-2026-11676",
    "CVE-2026-11677",
    "CVE-2026-11678",
    "CVE-2026-11679",
    "CVE-2026-11680",
    "CVE-2026-11681",
    "CVE-2026-11682",
    "CVE-2026-11683",
    "CVE-2026-11684",
    "CVE-2026-11685",
    "CVE-2026-11686",
    "CVE-2026-11687",
    "CVE-2026-11688",
    "CVE-2026-11689",
    "CVE-2026-11690",
    "CVE-2026-11691",
    "CVE-2026-11692",
    "CVE-2026-11693",
    "CVE-2026-11694",
    "CVE-2026-11695",
    "CVE-2026-11696",
    "CVE-2026-11697",
    "CVE-2026-11698",
    "CVE-2026-11699",
    "CVE-2026-11700",
    "CVE-2026-11701"
  );
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2026/06/23");
  script_xref(name:"IAVA", value:"2026-A-0557");

  script_name(english:"Google Chrome < 149.0.7827.102 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"A web browser installed on the remote macOS host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Google Chrome installed on the remote macOS host is prior to 149.0.7827.102. It is, therefore, affected
by multiple vulnerabilities as referenced in the 2026_06_stable-channel-update-for-desktop_0153744567 advisory.

  - Use after free in Tracing in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had
    compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.
    (Chromium security severity: Medium) (CVE-2026-11700)

  - Insufficient validation of untrusted input in Extensions in Google Chrome prior to 149.0.7827.103 allowed
    a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML
    page. (Chromium security severity: High) (CVE-2026-11658)

  - Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a local attacker to potentially
    exploit heap corruption via physical access to the device. (Chromium security severity: Critical)
    (CVE-2026-11628)

  - Use after free in Ozone in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially
    exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) (CVE-2026-11629)

  - Use after free in File Input in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to
    potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
    (CVE-2026-11630)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://chromereleases.googleblog.com/2026/06/stable-channel-update-for-desktop_0153744567.html
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?f39848a0");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/516501794");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/516674532");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/516677924");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/516691130");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/516707881");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/516963272");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/516975148");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/516987814");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/517023053");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/517040438");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/517047197");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/517227707");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/517339758");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/517418936");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/517678820");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/518006379");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/518043597");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/506689381");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/517168239");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/502156940");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/506684534");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/511270083");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/511279942");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/511736002");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/513156160");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/513321171");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/513362710");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/513396305");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/513424000");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/513465272");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/513564337");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/513702971");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/513731890");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/513748868");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/513773313");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/513820666");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/513830374");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/513948465");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/514009323");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/514671098");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/515419790");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/515429352");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/515469283");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/516608438");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/516794471");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/516902973");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/516910450");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/516915337");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/516949298");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/516979551");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/516986556");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/516997135");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/517004487");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/517050585");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/517103584");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/517129549");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/517130229");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/517183713");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/517247333");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/517303276");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/517309206");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/517486004");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/517533654");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/517585486");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/517607902");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/517644287");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/517705966");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/517762104");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/517993381");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/518105731");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/518235412");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/518237527");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/511732085");
  script_set_attribute(attribute:"see_also", value:"https://crbug.com/516413817");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Google Chrome version 149.0.7827.102 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-11700");
  script_set_attribute(attribute:"cvss3_score_source", value:"CVE-2026-11658");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/06/08");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/06/08");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:google:chrome");
  script_set_attribute(attribute:"generated_plugin", value:"current");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"MacOS X Local Security Checks");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("macosx_google_chrome_installed.nbin");
  script_require_keys("installed_sw/Google Chrome");

  exit(0);
}

include('vdf.inc');

# @tvdl-content-verify-only
var vuln_data = {
  "metadata": {
    "spec_version": "1.0"
  },
  "requires": [
    {
      "scope": "target",
      "match": {
        "os": "macos"
      }
    }
  ],
  "checks": [
    {
      "product": {
        "name": "Google Chrome",
        "type": "app"
      },
      "check_algorithm": "default",
      "constraints": [
        {
          "fixed_version": "149.0.7827.102",
          "fixed_display": "149.0.7827.102/.103"
        }
      ]
    }
  ]
};

var vdf_result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:vdf_result);