Google Issues Emergency Chrome Update Patching Seven Vulnerabilities Including Three Critical Flaws
Google has published a new security update for its Chrome web browser that resolves seven vulnerabilities, three of which are rated Critical. The update arrives only two days after the previous release on July 14, 2026, and targets the most recent versions of the browser across major desktop platforms.
The company released Chrome 150.0.7871.129 and Chrome 150.0.7871.128 for Windows and macOS, while Linux users received version Chrome 150.0.7871.128. The fixes address a total of seven security issues discovered in various components of the browser.
Three vulnerabilities received the highest severity rating of Critical: CVE-2026-15899 affecting the CameraCapture module, CVE-2026-15900 in the GPU process, and CVE-2026-15901 related to Network handling. All three are Use After Free flaws that could allow remote attackers to execute arbitrary code or cause crashes.
The remaining four vulnerabilities were classified as High severity. These include CVE-2026-15903, an out-of-bounds access issue in the V8 JavaScript engine, along with additional Use After Free problems identified in the Cast, Ozone, and Aura components tracked as CVE-2026-15902, CVE-2026-15904, and CVE-2026-15905.
Google stated that the update will be deployed progressively to users over the next several days to weeks. Administrators and security teams are advised to ensure that Chrome instances are updated promptly to mitigate potential exploitation risks.
Related articles
Keycloak Cluster on Three VMs: Engineers Detail Embedded Infinispan Setup, HA Testing Failures, and Bug Fix
A team deployed Keycloak for 25,000–30,000 users across a country using three isolated VMs instead of Kubernetes. They chose Embedded Infinispan with JGroups over an external cluster to reduce failure points and maintain session replication. PostgreSQL with Patroni handled shared storage and JDBC_PING discovery. Testing revealed that full datacenter outages triggered split-brain conditions and 5xx errors that the built-in healthcheck could not resolve. The engineers wrote a Python watcher script to detect multiple coordinators in the JGROUPS_PING table and restart affected containers. They reported the recovery bug to the Keycloak project, which was confirmed and fixed in a later release. The production cluster now survives single-DC loss without session loss.
From UDP Probe to Working Tunnel: Analyzing Hysteria2 Behavior via QUIC, HTTP/3 and Client Events
A detailed technical study examined how commercial Hysteria2 VPN endpoints respond to different levels of network probing, starting from simple UDP packets and progressing to full QUIC handshakes and authenticated client connections. The research used custom NetProbe tools on Windows and Linux to test real subscription endpoints, capturing both external probe results and decrypted traffic from an instrumented Hysteria2 client. Simple UDP probes received no response and timed out, while properly formed QUIC Initial packets with TLS ClientHello and ALPN h3 successfully completed handshakes using TLS 1.3 and TLS_AES_256_GCM_SHA384. An unauthenticated HTTP/3 GET request triggered immediate connection closure with H3_NO_ERROR (code 0x100), whereas a legitimate client sending POST /auth with Hysteria-Auth headers received the expected 233 status confirming authentication and UDP forwarding support. Subsequent data transfer tests, including parallel requests and file downloads, were observed inside separate QUIC streams after authentication, confirming that the tunnel carried real traffic. The study highlights differences between external probing and authenticated client behavior, providing practical insight into how Hysteria2 servers handle reconnaissance versus legitimate VPN usage.
Unbound 1.26.1 Patches Critical DNSSEC Validator Flaw CVE-2026-81642 Enabling Remote Code Execution
NLnet Labs has released Unbound 1.26.1 to address CVE-2026-81642, a critical vulnerability in the DNSSEC validator that can cause service crashes and potential remote code execution. The flaw affects all versions up to and including 1.26.0 and is triggered when validating a malicious DNS zone. It resides in the handling of DNSKEY records, where a buffer overflow can occur during DNS response processing. The vulnerability carries a CVSS 4.0 score of 9.1 with a network attack vector, no privileges required, and no user interaction needed. Exploitation requires an attacker to control a malicious DNS zone that the resolver queries, which can lead to denial of service or RCE in the worst case. The update also includes fixes for eight additional security issues, including CVE-2026-82717 and CVE-2026-81634, both involving heap corruption.
BIND DNS Servers Receive Patches for 14 Vulnerabilities Including High-Severity DoS Flaws
The Internet Systems Consortium has released BIND 9 updates that address 14 vulnerabilities across multiple versions of the widely used DNS server software. Seven of the issues received a CVSS score of 7.5 and were rated high severity, while the remaining seven scored between 5.3 and 6.5. The most critical flaw allows an unauthenticated attacker to crash the named process with a single malformed SIG(0) request over DNS over HTTPS. Additional vulnerabilities enable cache poisoning through forged NXDOMAIN responses, downgraded secure delegations, and acceptance of unsigned answers, as well as resource exhaustion via uncontrolled cache growth and excessive CPU consumption. Affected releases span BIND 9.11.0 through 9.18.50, 9.20.0 through 9.20.27, and 9.21.0 through 9.21.25. No workarounds exist, making immediate upgrades to versions 9.20.29, 9.21.26, or 9.20.29-S1 the only mitigation. The ISC reports no known exploitation in the wild and none of the flaws appear in CISA’s Known Exploited Vulnerabilities catalog.