Google Issues Second Chrome Update This Week, Patching 83 Vulnerabilities Including Five Critical Flaws
Google has published its second Chrome security update of the week, resolving 83 vulnerabilities across Windows, macOS, and Linux.
The company released Chrome 157.0.8103.79 and Chrome 157.0.8103.78 for Windows and macOS, along with Chrome 157.0.8103.78 for Linux on November 11, 2026. This follows an earlier update issued on November 9 that addressed nine vulnerabilities, including CVE-2026-125350, which was already being exploited in the wild.
The latest patch set contains no reports of active exploitation. Five vulnerabilities are classified as Critical, the highest severity rating, and all involve Use After Free memory corruption issues.
The critical flaws are:
- CVE-2026-126885 in ServiceWorker
- CVE-2026-126895 in CSS
- CVE-2026-126879 in Layout
- CVE-2026-126846 in Skia
- CVE-2026-126911 in Accessibility
Users are strongly encouraged to update immediately to mitigate potential risks.
Related articles
Ivanti Patches 13 Vulnerabilities in Five Products, Including Two Critical Flaws
Ivanti has issued security updates for five enterprise products to address a total of 13 vulnerabilities, two of which carry a critical severity rating. The affected products include Ivanti Endpoint Manager, Ivanti Cloud Services Application, Ivanti Sentry, Ivanti Endpoint Manager Mobile, and Ivanti User Workspace Manager. The most severe issues allow unauthenticated remote code execution and unauthorized certificate manipulation. One critical flaw, CVE-2026-121653, affects the Core component of Ivanti EPM and scores 9.8 on CVSS v3.0. A second critical vulnerability, CVE-2026-121683, impacts Ivanti CSA version 5.0.8 and enables arbitrary addition or deletion of certificate registration data. The remaining vulnerabilities are rated high and affect multiple other Ivanti solutions.
Mozilla Releases Firefox 160 Fixing 99 Vulnerabilities Including Multiple High-Severity Issues
Mozilla Foundation has published Firefox 160 along with its extended support release, addressing a total of 99 vulnerabilities. Although no Critical-rated flaws were present, 57 vulnerabilities received a High severity rating. Among the notable issues is a Use-After-Free flaw in CanvasWebGL (CVE-2026-124907) that could enable privilege escalation and sandbox bypass. A separate Use-After-Free vulnerability tied to inter-process communication (CVE-2026-124903) also carries the risk of sandbox escape. Additional patches resolve Same-Origin Policy bypasses tracked as CVE-2026-124874 and CVE-2026-124902, along with numerous other security problems across the browser.
Dart and Flutter SDKs Patch Critical TLS Flaw Tied to Compromised eMudhra Certificates
Dart and Flutter teams released updates to block compromised intermediate certificates from the eMudhra certificate authority. The flaw affects applications built for Android, Windows, and Linux that rely on dart:io for HTTPS connections. Stable releases include Dart 3.13.7 and Flutter 3.47.8, while beta channels received Dart 3.14.0-315.3.beta and Flutter 3.50.0-0.2.pre. The root cause traces to insufficient randomness during key generation for eight eMudhra intermediate CAs disclosed in October 2026. Because dart:io uses its own BoringSSL implementation rather than system revocation lists, applications must be rebuilt and redistributed to users. Additional changes improve root certificate handling on Android 14 and later via Conscrypt APEX modules.
Vulnerability Management Evolution: From Manual Scans to Continuous Threat Exposure Management
This final installment of the Vulnerability Management for Beginners series examines how the discipline has transformed over recent years into an essential component of organizational risk management. The article highlights the dramatic increase in disclosed vulnerabilities, now approaching 48,000 per year, and stresses that fewer than one percent pose real-world risk. It details the shift toward automated asset inventory integrated with SIEM, EDR, and CMDB systems, alongside multi-factor prioritization combining CVSS, EPSS, KEV lists, and FSTEC methodologies. New practices such as EASM, automated penetration testing, BAS, and CTEM are presented as extensions of a mature foundational process rather than replacements. The piece also covers regulatory tightening in Russia through FSTEC Order No. 117, mandatory remediation timelines, and the impact of AI on both defense and attack surfaces. It concludes with a practical Monday-morning action list focused on asset counting, threat feed integration, SLA definition, and cross-team coordination between IT and security.