Mozilla, Google, Adobe and Broadcom Patch Critical Security Flaws
Summary
Mozilla, Google, Adobe and Broadcom issued security updates covering critical flaws across Firefox, Chrome, Adobe products and VMware Avi Load Balancer. Firefox exploit code is public, but Mozilla says it knows of no in-the-wild attacks.
Key points
- Mozilla fixed CVE-2026-15718 and CVE-2026-15719 in Firefox 152.0.6; exploit code is public, but Mozilla reported no known in-the-wild exploitation.
- Google patched 15 Chrome flaws, including two critical use-after-free bugs in Ozone; fixes are available in Chrome 150.0.7871.124/.125, depending on platform.
- Adobe released updates addressing 88 vulnerabilities across ColdFusion, Commerce, Experience Manager and Illustrator, including critical flaws that could enable code execution or privilege escalation.
- Adobe fixed eight listed ColdFusion flaws in ColdFusion 2025 Update 11 and 2023 Update 22.
- Broadcom patched critical authentication bypass CVE-2026-47865 in VMware Avi Load Balancer; a network-accessible attacker could access the Avi Control plane.
- The article says none of the vulnerabilities are marked as actively exploited and advises organizations to install the updates.
Article Details
- Event Type
- Multiple vendors released security updates addressing critical vulnerabilities in browsers, Adobe products, and VMware Avi Load Balancer.
- Impact
- The flaws include issues that could enable arbitrary code execution, privilege escalation, and access to the Avi Control plane. Mozilla said exploit code for its two Firefox vulnerabilities was public, but it was not aware of attacks exploiting them in the wild. The article says none of the vulnerabilities had been marked as actively exploited.
CVE
CVE-2026-15718Mozilla has patched two critical Firefox vulnerabilities, CVE-2026-15718 and CVE-2026-15719, after warning that exploit code was already public.CVE-2026-15719Mozilla has patched two critical Firefox vulnerabilities, CVE-2026-15718 and CVE-2026-15719, after warning that exploit code was already public.CVE-2026-15764as Google shipped fixes for 15 security flaws, including two critical use-after-free bugs in Ozone (CVE-2026-15764 and CVE-2026-15765), a cross-platform abstraction layer that allows the browser to interact nativelyCVE-2026-15765fixes for 15 security flaws, including two critical use-after-free bugs in Ozone (CVE-2026-15764 and CVE-2026-15765), a cross-platform abstraction layer that allows the browser to interact natively with variousCVE-2026-47865has released a fix for a critical authentication bypass vulnerability in VMware Avi Load Balancer (CVE-2026-47865, CVSS score: 9.8) that a malicious user with network access can exploit to access the Avi ControlCVE-2026-48259CVE-2026-48259 (CVSS score: 9.6) – A server-side request forgery vulnerability in Adobe Experience Manager that could lead to arbitrary code executionCVE-2026-48284CVE-2026-48284 (CVSS score: 9.6) – An improper input validation vulnerability that could lead to arbitrary code execution CVE-2026-48318CVE-2026-48318 (CVSS score: 9.9) – A path traversal vulnerability that could lead to arbitrary code executionCVE-2026-48321CVE-2026-48321 (CVSS score: 9.3) – An incorrect authorization vulnerability that could lead to privilege escalationCVE-2026-48322CVE-2026-48322 (CVSS score: 9.6) – A code injection vulnerability that could lead to arbitrary code executionCVE-2026-48324CVE-2026-48324 (CVSS score: 9.1) – An SQL injection vulnerability that could lead to arbitrary code executionCVE-2026-48325CVE-2026-48325 (CVSS score: 9.3) – A missing authentication for a critical function vulnerability that could lead to arbitrary code executionCVE-2026-48356CVE-2026-48356 (CVSS score: 9.6) – A file upload vulnerability in Adobeâ¯Commerce andâ¯Magento Open Source that could lead to privilege escalationCVE-2026-48358CVE-2026-48358 (CVSS score: 9.1) – An improper encoding or escaping of output vulnerability in Adobeâ¯Commerce andâ¯Magento Open Source that could lead to arbitrary code executionCVE-2026-48359CVE-2026-48359 (CVSS score: 9.6) – An improper restriction of XML external entity reference vulnerability in Adobe Experience Manager that could lead to arbitrary code execution
People
Vendors
AdobeAdobe, Google, and Broadcom also released major security updates for products including ColdFusion, Chrome, Commerce, Experience Manager, Illustrator, and VMware Avi Load Balancer.BroadcomAdobe, Google, and Broadcom also released major security updates for products including ColdFusion, Chrome, Commerce, Experience Manager, Illustrator, and VMware Avi Load Balancer.GoogleAdobe, Google, and Broadcom also released major security updates for products including ColdFusion, Chrome, Commerce, Experience Manager, Illustrator, and VMware Avi Load Balancer.MozillaMozilla has patched two critical Firefox vulnerabilities, CVE-2026-15718 and CVE-2026-15719, after warning that exploit code was already public.
Products
Adobe ColdFusionAdobe, Google, and Broadcom also released major security updates for products including ColdFusion, Chrome, Commerce, Experience Manager, Illustrator, and VMware Avi Load Balancer.Adobe CommerceAdobe, Google, and Broadcom also released major security updates for products including ColdFusion, Chrome, Commerce, Experience Manager, Illustrator, and VMware Avi Load Balancer.Experience ManagerAdobe, Google, and Broadcom also released major security updates for products including ColdFusion, Chrome, Commerce, Experience Manager, Illustrator, and VMware Avi Load Balancer.Google ChromeAdobe, Google, and Broadcom also released major security updates for products including ColdFusion, Chrome, Commerce, Experience Manager, Illustrator, and VMware Avi Load Balancer.IllustratorAdobe, Google, and Broadcom also released major security updates for products including ColdFusion, Chrome, Commerce, Experience Manager, Illustrator, and VMware Avi Load Balancer.MagentoAlso fixed by Adobe are two critical flaws each in Adobeâ¯Commerce andâ¯Magento Open Source and Adobe Experience Manager –Mozilla FirefoxMozilla has patched two critical Firefox vulnerabilities, CVE-2026-15718 and CVE-2026-15719, after warning that exploit code was already public.VMware Avi Load BalancerAdobe, Google, and Broadcom also released major security updates for products including ColdFusion, Chrome, Commerce, Experience Manager, Illustrator, and VMware Avi Load Balancer.