Google Issues Emergency Chrome Update Patching Seven Vulnerabilities Including Three Critical Flaws
Google has published a new security update for its Chrome web browser that resolves seven vulnerabilities, three of which are rated Critical. The update arrives only two days after the previous release on July 14, 2026, and targets the most recent versions of the browser across major desktop platforms.
The company released Chrome 150.0.7871.129 and Chrome 150.0.7871.128 for Windows and macOS, while Linux users received version Chrome 150.0.7871.128. The fixes address a total of seven security issues discovered in various components of the browser.
Three vulnerabilities received the highest severity rating of Critical: CVE-2026-15899 affecting the CameraCapture module, CVE-2026-15900 in the GPU process, and CVE-2026-15901 related to Network handling. All three are Use After Free flaws that could allow remote attackers to execute arbitrary code or cause crashes.
The remaining four vulnerabilities were classified as High severity. These include CVE-2026-15903, an out-of-bounds access issue in the V8 JavaScript engine, along with additional Use After Free problems identified in the Cast, Ozone, and Aura components tracked as CVE-2026-15902, CVE-2026-15904, and CVE-2026-15905.
Google stated that the update will be deployed progressively to users over the next several days to weeks. Administrators and security teams are advised to ensure that Chrome instances are updated promptly to mitigate potential exploitation risks.
Related articles
WordPress Releases Security Update Fixing Two Vulnerabilities That Chain to Remote Code Execution
The WordPress development team has issued version 7.0.2 along with other security releases on July 17, 2026, addressing two critical vulnerabilities identified as CVE-2026-63030 and CVE-2026-60137. When combined, these flaws enable remote attackers to execute arbitrary code on affected installations. CVE-2026-60137 stems from insufficient input validation in certain functions, potentially allowing SQL injection when processing untrusted data from plugins or themes. CVE-2026-63030 involves route interpretation confusion in the REST API batch endpoint, which can be leveraged alongside the SQL injection issue to achieve code execution. The vulnerabilities impact WordPress 6.8 and later branches, although chained attacks are not possible on the 6.8 series. Administrators are urged to apply the updates immediately to mitigate the risks.
Weekly Roundup Highlights Critical Vulnerabilities in Zoom, nginx, SonicWall, and Microsoft Products
Security NEXT published its weekly ranking of the most-read articles for the period of July 12 to July 18, 2026. The top story covered a serious vulnerability in the Windows version of Zoom that has already been fixed in the latest release. Other high-ranking items included a cyber attack that disrupted operations at Nichirei and affected frozen food shipments, as well as Microsoft’s monthly security update addressing more than 500 vulnerabilities including zero-days. Additional widely read reports detailed multiple flaws in nginx, a zero-day issue affecting SonicWall SMA1000 series appliances, and a data exposure investigation involving a TV Asahi subsidiary. The list also featured advisories on GNU Wget SSRF flaws, privilege escalation bugs in Microsoft Defender, and 15 security fixes for Chrome including two rated critical.
OpenSSL Patches HollowByte Vulnerability That Enables Denial-of-Service Attacks on TLS Connections with Just 11 Bytes
OpenSSL has released fixes for a vulnerability dubbed HollowByte that allows denial-of-service attacks against servers using unpatched versions of the library. The flaw can be triggered by a malicious TLS request as small as 11 bytes and was addressed without a CVE or formal security advisory because it was classified as a hardening improvement. Researchers from Okta warn that the operational impact can be significant on internet-facing servers, as the issue occurs during the initial TLS handshake when vulnerable OpenSSL versions reserve memory based on the client-declared size before verifying actual data delivery. Attackers can open connections, claim they will send a large message, and then deliver only a tiny portion, leaving the server waiting indefinitely with reserved memory. In tests with NGINX, low-memory servers could be completely taken down while more powerful machines suffered substantial capacity loss without triggering abnormal traffic volumes. The patches are included in OpenSSL versions 4.0.1, 3.6.3, 3.5.7, 3.4.6, and 3.0.21, and administrators are advised to update packages, restart affected services, and monitor for unusual memory growth.
CISA Adds Three Exploited Vulnerabilities in FortiSandbox and SharePoint to KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on July 16, 2026. Two of the flaws affect Fortinet’s FortiSandbox malware analysis product and involve OS command injection issues that can be triggered via specially crafted HTTP requests without requiring authentication. The third vulnerability impacts Microsoft SharePoint and stems from unsafe deserialization of untrusted data, potentially allowing remote code execution over the network. CISA’s action follows public advisories released by the vendors in April and June 2026. The agency is urging organizations to apply available patches and mitigations immediately to reduce the risk of compromise.