Adobe, Chrome, Firefox, VMWare, and Zoom release critical security patches

Major technology companies including Adobe, Google, Mozilla, VMware, and Zoom have issued critical security patches to address a range of vulnerabilities across their products, emphasizing the urgency of timely updates to mitigate potential exploitation. The updates, released on July 16, 2026, target flaws in browsers, enterprise software, and collaboration tools, many of which could enable remote code execution, privilege escalation, or unauthorized access if left unpatched.

Google’s Chrome 150.0.7871.124 and 150.0.7871.125 addressed 15 security flaws, including two critical use-after-free vulnerabilities in the Ozone component. These issues, tracked as CVE-2026-15764 and CVE-2026-15765, pose significant risks due to their potential to allow attackers to execute malicious code. The update also resolved 12 high-severity bugs affecting areas such as Skia, Libyuv, and V8, with Google noting that none of the vulnerabilities were known to be actively exploited at the time of release. Mozilla followed with Firefox 152.0.6, which patched two critical flaws—CVE-2026-15718 and CVE-2026-15719—related to JavaScript/WebAssembly and DOM navigation. Mozilla warned that exploit code for both issues is publicly available, though no active attacks have been reported.

Adobe released updates for 88 vulnerabilities, including critical flaws in ColdFusion, Commerce/Magento Open Source, and Experience Manager. The ColdFusion bulletin alone highlighted multiple issues capable of enabling arbitrary code execution. Meanwhile, VMware addressed a critical authentication bypass in its Avi Load Balancer, tracked as CVE-2026-47865. This flaw could allow network-accessible attackers to reach the Avi Control Plane, a risk particularly acute for environments exposing management services or relying on load balancers at the network edge.

Zoom’s security bulletin ZSB-26014 targeted a critical issue in Zoom Workplace for Windows, described as improper input validation and tracked as CVE-2026-53412. The vulnerability could facilitate account takeovers, prompting the company to urge users to update to the patched version. Zoom’s advisory emphasized the need for both individual users and small businesses to ensure centralized deployment packages are also updated to prevent reinstallation of outdated builds.

The widespread release of exploit code for some vulnerabilities underscores the heightened risk for unpatched systems. For example, the flaws in Firefox’s WebAssembly component and DOM navigation could enable attackers to execute arbitrary code, escalate privileges, and move laterally within networks. Security researchers highlighted that these vulnerabilities, if exploited, could lead to data exfiltration, ransomware deployment, and operational disruptions. The Aviatrix.ai report noted that zero-trust security frameworks could limit the impact of such attacks by constraining lateral movement and command-and-control channels.

Organizations and individual users are advised to apply the updates immediately. For Chrome, versioning details and step-by-step guidance are available through Google’s support resources. Firefox users should restart the browser to apply fixes, while VMware and Adobe provide specific instructions in their security advisories. Zoom’s update process requires verifying that the latest version is deployed across all devices, including centralized systems.

The coordinated release of patches reflects ongoing efforts by vendors to address vulnerabilities proactively. However, the presence of public exploit code for several flaws highlights the critical window between disclosure and potential exploitation. Security experts warn that delayed updates increase the likelihood of attacks, particularly for systems handling sensitive data or critical infrastructure. As browser and software vulnerabilities remain prime targets for cybercriminals, timely patching remains a cornerstone of defensive strategies.