Palo Alto Networks Security Advisories / PAN-SA-2026-0007

PAN-SA-2026-0007 Chromium and Prisma Browser: Monthly Vulnerability Update (May 2026)

Urgency MODERATE

047910
Severity 6.1 · MEDIUM
Exploit Maturity UNREPORTED
Response Effort MODERATE
Recovery USER
Value Density DIFFUSE
Attack Vector NETWORK
Attack Complexity LOW
Attack Requirements NONE
Automatable NO
User Interaction ACTIVE
Product Confidentiality HIGH
Product Integrity HIGH
Product Availability HIGH
Privileges Required NONE
Subsequent Confidentiality NONE
Subsequent Integrity NONE
Subsequent Availability NONE
JSON CSAF
Published 2026-05-13
Updated 2026-05-13
Discovered externally

Description

Palo Alto Networks incorporated the following Chromium security fixes into our products:

CVESummary
CVE-2026-4439Out of bounds memory access in WebGL
CVE-2026-4440Out of bounds read and write in WebGL
CVE-2026-4441Use after free in Base
CVE-2026-4442Heap buffer overflow in CSS
CVE-2026-4443Heap buffer overflow in WebAudio
CVE-2026-4444Stack buffer overflow in WebRTC
CVE-2026-4445Use after free in WebRTC
CVE-2026-4446Use after free in WebRTC
CVE-2026-4447Inappropriate implementation in V8
CVE-2026-4448Heap buffer overflow in ANGLE
CVE-2026-4449Use after free in Blink
CVE-2026-4450Out of bounds write in V8
CVE-2026-4451Insufficient validation of untrusted input in Navigation
CVE-2026-4452Integer overflow in ANGLE
CVE-2026-4453Integer overflow in Dawn
CVE-2026-4454Use after free in Network
CVE-2026-4455Heap buffer overflow in PDFium
CVE-2026-4456Use after free in Digital Credentials API
CVE-2026-4457Type Confusion in V8
CVE-2026-4458Use after free in Extensions
CVE-2026-4459Out of bounds read and write in WebAudio
CVE-2026-4460Out of bounds read in Skia
CVE-2026-4461Inappropriate implementation in V8
CVE-2026-4462Out of bounds read in Blink
CVE-2026-4463Heap buffer overflow in WebRTC
CVE-2026-4464Integer overflow in ANGLE
CVE-2026-4673Heap buffer overflow in WebAudio
CVE-2026-4674Out of bounds read in CSS
CVE-2026-4675Heap buffer overflow in WebGL
CVE-2026-4676Use after free in Dawn
CVE-2026-4677Inappropriate implementation in WebAudio
CVE-2026-4678Use after free in WebGPU
CVE-2026-4679Integer overflow in Fonts
CVE-2026-4680Use after free in FedCM
CVE-2026-5272Heap buffer overflow in GPU
CVE-2026-5273Use after free in CSS
CVE-2026-5274Integer overflow in Codecs
CVE-2026-5275Heap buffer overflow in ANGLE
CVE-2026-5276Insufficient policy enforcement in WebUSB
CVE-2026-5277Integer overflow in ANGLE
CVE-2026-5278Use after free in Web MIDI
CVE-2026-5279Object corruption in V8
CVE-2026-5280Use after free in WebCodecs
CVE-2026-5281Use after free in Dawn
CVE-2026-5282Out of bounds read in WebCodecs
CVE-2026-5283Inappropriate implementation in ANGLE
CVE-2026-5284Use after free in Dawn
CVE-2026-5285Use after free in WebGL
CVE-2026-5286Use after free in Dawn
CVE-2026-5287Use after free in PDF
CVE-2026-5288Use after free in WebView
CVE-2026-5289Use after free in Navigation
CVE-2026-5290Use after free in Compositing
CVE-2026-5291Inappropriate implementation in WebGL
CVE-2026-5292Out of bounds read in WebCodecs
CVE-2026-5876Side-channel information leakage in Navigation
CVE-2026-5881Policy bypass in LocalNetworkAccess
CVE-2026-5884Insufficient validation of untrusted input in Media
CVE-2026-5886Out of bounds read in WebAudio
CVE-2026-5893Race in V8
CVE-2026-5909Integer overflow in Media
CVE-2026-5914Type Confusion in CSS
CVE-2026-5919Insufficient validation of untrusted input in WebSockets
CVE-2026-6305Heap buffer overflow in PDFium
CVE-2026-6361Heap buffer overflow in PDFium
CVE-2026-6921Race in GPU
CVE-2026-7343Use after free in Views
CVE-2026-7359Use after free in ANGLE
CVE-2026-7361Use after free in iOS
CVE-2026-7363Use after free in Canvas
CVE-2026-7981Out of bounds read in Codecs
CVE-2026-8018Insufficient policy enforcement in DevTools
CVE-2026-8022Inappropriate implementation in MHTML
CVE-2026-0237Prisma Browser: Improperly Restricted Automation Bridge Allows Security Bypass
CVE-2026-0236Prisma Browser: Code Injection Enables Security Controls Bypass
CVE-2026-0235Prisma Browser: Access and Data Rule Bypass

Product Status

VersionsAffectedUnaffected
Prisma Browser< 146.10.7.154
>= 148.6.3.96

Required Configuration for Exposure

No special configuration is required to be affected by this issue.

Severity: MEDIUM, Suggested Urgency: MODERATE

CVSS-BT: 6.1 / CVSS-B: 8.6 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/AU:N/R:U/V:D/RE:M/U:Amber)

Exploitation Status

Palo Alto Networks is not aware of any malicious exploitation of this issue.

Solution

CVEPrisma Browser
CVE-2026-4439
146.10.7.154
CVE-2026-4440
146.10.7.154
CVE-2026-4441
146.10.7.154
CVE-2026-4442
146.10.7.154
CVE-2026-4443
146.10.7.154
CVE-2026-4444
146.10.7.154
CVE-2026-4445
146.10.7.154
CVE-2026-4446
146.10.7.154
CVE-2026-4447
146.10.7.154
CVE-2026-4448
146.10.7.154
CVE-2026-4449
146.10.7.154
CVE-2026-4450
146.10.7.154
CVE-2026-4451
146.10.7.154
CVE-2026-4452
146.10.7.154
CVE-2026-4453
146.10.7.154
CVE-2026-4454
146.10.7.154
CVE-2026-4455
146.10.7.154
CVE-2026-4456
146.10.7.154
CVE-2026-4457
146.10.7.154
CVE-2026-4458
146.10.7.154
CVE-2026-4459
146.10.7.154
CVE-2026-4460
146.10.7.154
CVE-2026-4461
146.10.7.154
CVE-2026-4462
146.10.7.154
CVE-2026-4463
146.10.7.154
CVE-2026-4464
146.10.7.154
CVE-2026-4673
146.16.6.165
CVE-2026-4674
146.16.6.165
CVE-2026-4675
146.16.6.165
CVE-2026-4676
146.16.6.165
CVE-2026-4677
146.16.6.165
CVE-2026-4678
146.16.6.165
CVE-2026-4679
146.16.6.165
CVE-2026-4680
146.16.6.165
CVE-2026-5272
146.16.9.178
CVE-2026-5273
146.16.9.178
CVE-2026-5274
146.16.9.178
CVE-2026-5275
146.16.9.178
CVE-2026-5276
146.16.9.178
CVE-2026-5277
146.16.9.178
CVE-2026-5278
146.16.9.178
CVE-2026-5279
146.16.9.178
CVE-2026-5280
146.16.9.178
CVE-2026-5281
146.16.9.178
CVE-2026-5282
146.16.9.178
CVE-2026-5283
146.16.9.178
CVE-2026-5284
146.16.9.178
CVE-2026-5285
146.16.9.178
CVE-2026-5286
146.16.9.178
CVE-2026-5287
146.16.9.178
CVE-2026-5288
146.16.9.178
CVE-2026-5289
146.16.9.178
CVE-2026-5290
146.16.9.178
CVE-2026-5291
146.16.9.178
CVE-2026-5292
146.16.9.178
CVE-2026-5876
147.15.6.102
CVE-2026-5881
147.15.6.102
CVE-2026-5884
147.15.6.102
CVE-2026-5886
147.15.6.102
CVE-2026-5893
147.15.6.102
CVE-2026-5909
147.15.6.102
CVE-2026-5914
147.15.6.102
CVE-2026-5919
147.15.6.102
CVE-2026-6305
147.15.6.102
CVE-2026-6361
147.15.6.102
CVE-2026-6921
147.21.3.117
CVE-2026-7343
147.28.2.138
CVE-2026-7359
147.28.2.138
CVE-2026-7361
147.28.2.138
CVE-2026-7363
147.28.2.138
CVE-2026-7981
148.6.3.96
CVE-2026-8018
148.6.3.96
CVE-2026-8022
148.6.3.96
CVE-2026-0237146.16.6.165
CVE-2026-0236146.16.6.165
CVE-2026-0235146.16.6.165

Workarounds and Mitigations

No known workarounds exist for this issue.

Acknowledgments

Palo Alto Networks thanks Tan Inn Fung, Yu Ann Ong, Zhang Bosen from the GovTech Cybersecurity Group for discovering and reporting CVE-2026-0235 and Cisors for discovering and reporting CVE-2026-TW-0236 and CVE-2026-0237 issues.

CPE Applicability

Timeline

Initial Publication
Terms of usePrivacyProduct Security Assurance and Vulnerability Disclosure PolicyReport vulnerabilitiesManage subscriptions
© 2026 Palo Alto Networks, Inc. All rights reserved.