bk99.de entertain the web since 1997

bk99.de
hß · SecurityCurated

Palo Alto Networks: numerous security holes in Prisma Browser closed

Summary

In August 2026 Palo Alto Networks closed numerous holes, most of them in the Chromium-based enterprise browser Prisma Browser. There, memory bugs could lead to code execution; version 150.49.8.187 was fixed. Further holes affected the GlobalProtect VPN client on Android, macOS and Windows, including a privilege escalation (CVE-2026-0299).

Ideas

  • Chromium-based enterprise browsers inherit its memory bugs.
  • CVSS 4.0 distinguishes the base score from a score that includes the current threat situation.
  • The absence of attacks lowers the urgency, not the severity.
  • VPN clients can grant local admin rights.

Insights

  • Additional security products bring their own attack surface.
  • Threat-based scores help with prioritisation but do not replace prompt patching.

Facts

  • For Prisma Browser, CVSS-B 9.2 and CVSS-BT 7.2 applied.
  • No attacks were known at the time of the report.

References

Critique

  • The report lists products without classifying the individual holes technically.

Recommendations

  • Include enterprise browsers and VPN clients in regular patch management.
  • Use CVSS-BT for prioritisation, but also plan prompt updates for holes that are not being exploited.

Read the original article

Search the Web Archive

hß · 2025

Google Chrome: critical security hole in web browser

In August 2025 Google closed a critical hole in Chrome (CVE-2025-9478), a use-after-free bug in the WebGL backend ANGLE. Attackers could exploit the memory bug via prepared websites, which usually leads to the execution of malicious code. The hole was fixed in Chrome 139.0.7258.154/155; Chromium-based browsers such as Edge are likely to be affected as well.

hß · 2024

Security holes: network monitoring tool Zabbix can leak passwords

In August 2024 Zabbix closed eight security holes in its network monitoring. The most serious was CVE-2024-22116, through which administrators with restricted rights could execute code in the context of the ping script. In addition, the frontend’s audit log displayed passwords in plain text.

hß · 2023

Security holes: patches protect Cisco firewalls and switches

In August 2023 Cisco closed several holes in firewalls and switches. Rated high were an SNMP hole in Firepower 4100 and 9300 through which authenticated attackers could trigger restarts, an IS-IS hole in Nexus 3000 and 9000 without authentication, and a DoS hole in NX-OS. Further medium holes affected, among others, the Application Policy Infrastructure Controller.