PAN-SA-2026-0012 Chromium: Monthly Vulnerability Update (September 2026)
Exploit Maturity
UNREPORTED
Response Effort
MODERATE
Recovery
USER
Value Density
DIFFUSE
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Automatable
NO
User Interaction
PASSIVE
Product Confidentiality
HIGH
Product Integrity
HIGH
Product Availability
HIGH
Privileges Required
NONE
Subsequent Confidentiality
HIGH
Subsequent Integrity
HIGH
Subsequent Availability
HIGH
Description
Palo Alto Networks incorporated the following Chromium security fixes into our products:
- https://chromereleases.googleblog.com/2026/09/stable-channel-update-for-desktop.html
- https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0256176589.html
- https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0404570826.html
- https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_0826575033.html
- https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01815628406.html
- https://chromereleases.googleblog.com/2026/08/stable-channel-update-for-desktop_01193673229.html
| CVE | Summary |
|---|---|
| CVE-2026-76020 | Race condition in V8 |
| CVE-2026-76022 | Buffer overflow in Network |
| CVE-2026-76038 | Type confusion in V8 |
| CVE-2026-76046 | Buffer overflow in ANGLE |
| CVE-2026-76047 | Type confusion in V8 |
| CVE-2026-79016 | Observable discrepancy in SVG |
| CVE-2026-79032 | Improper input validation in Network |
| CVE-2026-79118 | Uninitialized resource in ANGLE |
| CVE-2026-79195 | Use after free in Script |
| CVE-2026-79282 | Use after free in ANGLE |
| CVE-2026-79286 | Missing authorization in CustomTabs |
| CVE-2026-79290 | Use after free in Aura |
| CVE-2026-79293 | Information leak in Animation |
| CVE-2026-84348 | Information leak in MediaCapture |
| CVE-2026-84350 | Use after free in TabStrip |
| CVE-2026-84351 | Buffer overflow in GPU |
| CVE-2026-84357 | Improper input validation in Omnibox |
| CVE-2026-84358 | Improper privilege management in Downloads |
| CVE-2026-84359 | Information leak in Skia |
Product Status
| Versions | Affected | Unaffected |
|---|---|---|
| Prisma Browser | < 151.26.5.170 | >= 152.8.4.76 |
Required Configuration for Exposure
No special configuration is required to be affected by this issue.
Severity: HIGH, Suggested Urgency: MODERATE
CVSS-BT: 7.7 / CVSS-B: 9.4 (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/AU:N/R:U/V:D/RE:M/U:Amber)
Exploitation Status
Palo Alto Networks is not aware of any malicious exploitation of this issue.
Solution
| CVE | Prisma Browser |
|---|---|
| CVE-2026-76038 | 151.26.5.170 |
| CVE-2026-76046 | 151.26.5.170 |
| CVE-2026-76047 | 151.26.5.170 |
| CVE-2026-76020 | 151.26.6.174 |
| CVE-2026-76022 | 151.26.6.174 |
| CVE-2026-79016 | 152.8.3.65 |
| CVE-2026-79032 | 152.8.3.65 |
| CVE-2026-79118 | 152.8.3.65 |
| CVE-2026-79195 | 152.8.3.65 |
| CVE-2026-79282 | 152.8.3.65 |
| CVE-2026-79286 | 152.8.3.65 |
| CVE-2026-79290 | 152.8.3.65 |
| CVE-2026-79293 | 152.8.3.65 |
| CVE-2026-84348 | 152.8.4.76 |
| CVE-2026-84350 | 152.8.4.76 |
| CVE-2026-84351 | 152.8.4.76 |
| CVE-2026-84357 | 152.8.4.76 |
| CVE-2026-84358 | 152.8.4.76 |
| CVE-2026-84359 | 152.8.4.76 |
Workarounds and Mitigations
No known workarounds exist for this issue.
CPE Applicability
- cpe:2.3:a:palo_alto_networks:prisma_browser:*:*:*:*:*:*:*:* is vulnerable from (including)151.26.5 and up to (excluding)152.8.4.76
Timeline
Initial Publication