Firefox, Chrome, Adobe, and VMware Updates Fix Multiple Critical Security Flaws
Summary: Mozilla released Firefox 152.0.6 to fix two critical flaws for which it said exploit code is public, though it reported no attacks in the wild. The same round of updates includes Google's fix for 15 Chrome flaws, among them two critical use-after-free bugs in Ozone (CVE-2026-15764 and CVE-2026-15765), Adobe patches for 88 vulnerabilities including eight in ColdFusion, and a Broadcom fix for a VMware Avi Load Balancer authentication bypass (CVE-2026-47865) rated 9.8.
What you should know: The VMware Avi Load Balancer flaw carries a CVSS score of 9.8 and lets anyone with network access reach the Avi Control plane, and it was found by Filip Waeytens of the NATO Cyber Security Centre. None of these flaws is marked as actively exploited yet, but public exploit code already exists for the Firefox bugs.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-15764CVE-2026-15765CVE-2026-47865
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026