Firefox, Chrome, Adobe, and VMware Critical Patches: Why Browser and Enterprise Updates Cannot Wait

Mozilla, Google, Adobe, and Broadcom have released security updates for critical vulnerabilities affecting browsers, web platforms, enterprise applications, and VMware Avi Load Balancer, showing why patching is now a cross-stack security priority.

Security teams are used to Patch Tuesday.

But not every urgent patch arrives inside a single vendor’s monthly cycle.

Sometimes the real risk comes from the combination of multiple vendors releasing critical fixes at the same time: browsers, web application platforms, commerce systems, content management tools, and enterprise infrastructure.

That is exactly what happened with the latest security updates from Mozilla, Google, Adobe, and Broadcom VMware.

Mozilla patched two critical Firefox flaws for which exploit code is already public.

Google fixed critical use-after-free bugs in Chrome.

Adobe published updates for dozens of vulnerabilities across products including ColdFusion, Adobe Commerce, Magento Open Source, Adobe Experience Manager, and Illustrator.

Broadcom fixed a critical authentication bypass in VMware Avi Load Balancer that could allow a network attacker to access the Avi Control Plane.

None of these vulnerabilities should be treated as isolated technical details.

Together, they show the modern patching problem: attackers do not care whether a bug lives in a browser, a web server, a commerce platform, or a load balancer. They care whether it gives them execution, access, persistence, privilege, or a path into the environment.

The practical lesson is simple: update quickly, prioritize internet-facing systems, and do not ignore browsers just because they sit on user endpoints.

What Was Patched?

The latest updates cover four major areas of the modern enterprise attack surface.

Firefox received fixes for two critical vulnerabilities in version 152.0.6.

Google Chrome received fixes for 15 security flaws, including two critical use-after-free vulnerabilities in Ozone, a cross-platform abstraction layer used by the browser.

Adobe released updates for 88 vulnerabilities, including multiple critical-severity flaws in ColdFusion, Commerce, Magento Open Source, Experience Manager, and Illustrator.

VMware Avi Load Balancer, now under Broadcom, received fixes for several flaws, including CVE-2026–47865, a critical authentication bypass with a CVSS score of 9.8.

This is not just a browser update story.

It is a full-stack security story.

The vulnerable products sit across endpoints, web-facing servers, digital commerce environments, content platforms, and load-balancing infrastructure.

That means the risk is distributed across both users and servers.

A malicious web page can target a browser.

A vulnerable ColdFusion server can expose an enterprise application.

A vulnerable commerce platform can affect online stores and customer data.

A vulnerable load balancer can expose the control plane of critical infrastructure.

The attack surface is broad, and the patch window is narrow.

Firefox 152.0.6: Public Exploit Code Changes the Risk

Mozilla fixed two critical vulnerabilities in Firefox 152.0.6:

CVE-2026–15718, an invalid pointer issue in the JavaScript: WebAssembly component.

CVE-2026–15719, a site isolation issue in the DOM: Navigation component.

Mozilla stated that exploit code for the flaws is public, although it has not observed attacks in the wild at the time of the advisory.

That distinction matters.

A vulnerability with public exploit code is more urgent than a vulnerability known only through a private report.

Public exploit code reduces the barrier to abuse. Attackers do not need to rediscover the bug from scratch. They can test, adapt, weaponize, and integrate the exploit into phishing, malvertising, watering-hole, or drive-by attack chains.

The absence of known exploitation is good news.

But it should not create complacency.

Public exploit code can turn into real-world exploitation quickly, especially for browser vulnerabilities.

Browsers are among the most exposed applications on any endpoint. They process untrusted content all day: pages, scripts, media, fonts, WebAssembly modules, extensions, downloads, documents, and authentication flows.

That makes Firefox updates especially important for both individual users and enterprise-managed endpoints.

Why WebAssembly Bugs Matter

One of the Firefox vulnerabilities affects JavaScript: WebAssembly.

WebAssembly, often shortened to Wasm, is a low-level binary instruction format designed to run high-performance code inside browsers. It powers games, graphics tools, editors, simulations, cryptographic libraries, development environments, and complex web applications.

From a security perspective, WebAssembly is important because it sits close to performance-sensitive browser execution.

Browsers work hard to sandbox and constrain WebAssembly, but bugs in the engine, pointer handling, memory management, or JIT-related logic can become valuable to attackers.

An invalid pointer issue may sound abstract, but pointer mistakes are often serious in low-level execution contexts. Depending on conditions, such flaws can lead to crashes, memory corruption, or more dangerous exploit paths.

This does not mean every WebAssembly bug becomes remote code execution.

But it does mean defenders should patch quickly when a browser vendor rates the issue critical and exploit code is public.

Site Isolation and DOM Navigation Risk

The second Firefox flaw, CVE-2026–15719, involves site isolation in the DOM: Navigation component.

Site isolation is a browser security architecture designed to separate content from different websites into different processes or security contexts. The goal is to reduce the impact of compromised renderers, cross-site data leaks, and attacks that attempt to break web origin boundaries.

The DOM, or Document Object Model, is the browser’s structured representation of a web page. Navigation logic determines how pages move between documents, origins, frames, and browsing contexts.

A bug in this area can matter because browsers rely heavily on origin separation.

Modern web security depends on the browser correctly enforcing which site can access which data.

If site isolation fails, attackers may gain opportunities to weaken sandbox boundaries, confuse origin checks, or interact with content in ways the browser should prevent.

Again, the practical message is not theoretical: update Firefox to 152.0.6 or later.

Chrome: Critical Use-After-Free Bugs in Ozone

Google patched 15 security flaws in Chrome, including two critical use-after-free vulnerabilities in Ozone:

CVE-2026–15764.

CVE-2026–15765.

Ozone is a cross-platform abstraction layer that helps Chrome interact with display servers and windowing systems across environments such as Linux, ChromeOS, and Fuchsia.

The NVD description for CVE-2026–15764 notes that a remote attacker who convinces a user to perform specific UI gestures could potentially exploit heap corruption through a crafted HTML page on affected Linux versions.

That phrase contains several important details.

The attacker is remote.

The user may need to interact with the page.

The exploit involves crafted web content.

The impact involves heap corruption.

Heap corruption is a serious class of memory safety issue. In browsers, memory corruption bugs can sometimes be chained with sandbox escapes or other vulnerabilities to achieve deeper compromise.

Google fixed the issues in Chrome 150.0.7871.124/.125 for Windows and Mac and 150.0.7871.124 for Linux, according to the reporting.

For organizations, the key point is that browser updates must be managed centrally.

Chrome auto-update helps, but enterprises should verify deployment. Delayed browser updates create a window where users can be targeted through malicious links, compromised websites, poisoned ads, or phishing pages.

Why Browser Patching Is Enterprise Security

Browsers are no longer simple user applications.

They are enterprise platforms.

Employees use browsers to access email, identity portals, SaaS applications, financial systems, cloud consoles, source code repositories, AI tools, CRM platforms, HR systems, and internal web apps.

A browser compromise can become an identity compromise.

A browser exploit can expose tokens, sessions, cookies, credentials, and sensitive business data.

A malicious web page can be enough to trigger a vulnerable code path if the browser is unpatched.

This is why Firefox and Chrome patching should be part of endpoint security operations, not left to users.

Organizations should monitor browser versions, enforce update baselines, block outdated browser versions, and ensure that unmanaged devices do not access sensitive systems without security controls.

The endpoint perimeter now includes the browser.

Adobe’s 88 Vulnerabilities: ColdFusion, Commerce, Experience Manager, and Illustrator

Adobe released security updates for 88 vulnerabilities, including multiple critical bugs across several major products.

The highest-risk areas include:

Adobe ColdFusion.

Adobe Commerce.

Magento Open Source.

Adobe Experience Manager.

Adobe Illustrator.

ColdFusion is especially important because it is commonly deployed as a web application server. Vulnerabilities in ColdFusion can affect internet-facing enterprise applications and internal business systems.

Adobe’s ColdFusion fixes include several high-severity and critical issues, such as path traversal, code injection, improper input validation, incorrect authorization, missing authentication for a critical function, SQL injection, and arbitrary code execution paths.

The reported ColdFusion issues include:

CVE-2026–48318, a path traversal vulnerability that could lead to arbitrary code execution.

CVE-2026–48322, a code injection vulnerability that could lead to arbitrary code execution.

CVE-2026–48284, an improper input validation vulnerability that could lead to arbitrary code execution.

CVE-2026–48321, an incorrect authorization vulnerability that could lead to privilege escalation.

CVE-2026–48325, a missing authentication vulnerability for a critical function that could lead to arbitrary code execution.

CVE-2026–48319, another path traversal vulnerability that could lead to arbitrary code execution.

CVE-2026–48324, an SQL injection vulnerability that could lead to arbitrary code execution.

CVE-2026–48327, an incorrect authorization vulnerability that could lead to arbitrary code execution.

ColdFusion flaws have historically attracted attacker attention because the product often sits on internet-facing servers and hosts business-critical applications.

That makes these updates high priority.

ColdFusion: Why Server-Side Bugs Are High Impact

ColdFusion vulnerabilities are different from browser vulnerabilities.

A browser bug often requires attacking users.

A ColdFusion bug can target the server directly.

If a vulnerable ColdFusion server is exposed to the internet, attackers may be able to scan for it, fingerprint versions, test endpoints, exploit path traversal or code injection, and attempt server-side execution.

Once a web application server is compromised, attackers can attempt to deploy web shells, steal data, move laterally, access databases, harvest credentials, or use the host as a pivot point.

That is why ColdFusion should be patched quickly.

The fixed versions cited in the report are ColdFusion 2025 Update 11 and ColdFusion 2023 Update 22.

Organizations should not only patch.

They should also review logs and look for signs of exploitation, especially if ColdFusion was internet-facing before the update.

Adobe Commerce and Magento Open Source

Adobe also fixed critical flaws in Adobe Commerce and Magento Open Source.

These platforms are highly sensitive because they process online store data, customer accounts, payment workflows, orders, inventory, admin sessions, and business revenue.

The critical issues include:

CVE-2026–48356, a file upload vulnerability that could lead to privilege escalation.

CVE-2026–48358, an improper output encoding or escaping issue that could lead to arbitrary code execution.

For e-commerce systems, the business risk is immediate.

A compromise can lead to stolen customer data, malicious checkout scripts, payment skimming, administrator account takeover, fraudulent orders, SEO spam, redirect attacks, or supply-chain-style exposure to customers.

E-commerce patching should be treated as both a security issue and a revenue protection issue.

If Adobe Commerce or Magento Open Source is exposed to the internet, these patches should be prioritized.

Adobe Experience Manager: SSRF and XXE Risk

Adobe Experience Manager also received fixes for critical vulnerabilities, including:

CVE-2026–48259, a server-side request forgery vulnerability that could lead to arbitrary code execution.

CVE-2026–48359, an improper restriction of XML external entity reference vulnerability that could lead to arbitrary code execution.

Both bug classes are significant.

SSRF, or server-side request forgery, allows an attacker to make the server send requests to unintended locations. This can expose internal services, metadata endpoints, cloud credentials, backend APIs, or protected resources.

XXE, or XML external entity abuse, occurs when XML parsers process external entities unsafely. Depending on configuration, XXE can lead to file disclosure, internal network access, denial of service, or code execution in some environments.

Experience Manager is often used in enterprise digital experience and content management environments. That means it may be internet-facing, integrated with identity systems, connected to content repositories, and exposed to external traffic.

Critical AEM vulnerabilities deserve rapid review and patching.

VMware Avi Load Balancer CVE-2026–47865

Broadcom released a fix for CVE-2026–47865, a critical authentication bypass vulnerability in VMware Avi Load Balancer.

Broadcom assigned it a CVSSv3 score of 9.8.

The advisory says a malicious user with network access may be able to access the Avi Control Plane by bypassing authentication.

This is a serious enterprise infrastructure issue.

Load balancers are not ordinary servers. They sit in front of applications, route traffic, terminate connections, enforce policies, support availability, and often integrate with cloud and data center control planes.

If attackers can access the control plane, they may be able to manipulate configurations, disrupt availability, expose traffic, modify routing, access sensitive operational details, or create conditions for deeper compromise.

The vulnerability was credited to Filip Waeytens of the NATO Cyber Security Centre, according to Broadcom’s advisory.

Even though active exploitation had not been reported at the time of the cited article, the severity and role of the product make patching urgent.

Why Control Plane Vulnerabilities Are Strategic

Control planes are high-value targets.

A control plane manages other systems.

In a load balancer, the control plane may define virtual services, routing rules, certificates, pools, policies, health checks, access controls, and operational behavior.

If attackers gain unauthorized access, they may not need to compromise every backend server individually. They can attack the layer that controls how traffic reaches those servers.

This can lead to:

Application disruption.

Traffic interception opportunities.

Configuration tampering.

Certificate exposure.

Service degradation.

Access to operational metadata.

Creation of malicious routing rules.

Persistence through configuration changes.

That is why authentication bypass in a control plane is critical.

The attack may begin as an access control failure, but the impact can become infrastructure-level.

No Active Exploitation Does Not Mean Low Risk

The article notes that none of these vulnerabilities had been marked as actively exploited at the time of publication.

That is positive.

But it is not a reason to delay.

There are three reasons.

First, exploit code is already public for the Firefox flaws.

Second, several vulnerabilities affect internet-facing enterprise products.

Third, attackers are known to weaponize flaws in browsers, ColdFusion, commerce platforms, content management systems, and infrastructure control planes.

In modern vulnerability management, “not known to be exploited” means exactly that.

It does not mean “not exploitable.”

It does not mean “safe.”

It does not mean “can wait for months.”

Once patches are public, attackers can analyze them, compare versions, and develop exploit logic. The patch release itself becomes a roadmap.

The safe window is getting smaller.

Practical Patch Priority

A realistic patch priority should consider exposure and role.

For individual users and endpoint teams, update Firefox and Chrome immediately, especially where users browse the web, handle email, access SaaS platforms, or use privileged accounts.

For server teams, prioritize Adobe ColdFusion if exposed to the internet or used for business-critical applications.

For e-commerce teams, update Adobe Commerce and Magento Open Source quickly to reduce the risk of privilege escalation, code execution, and storefront compromise.

For digital experience teams, update Adobe Experience Manager, especially internet-facing author or publish environments.

For infrastructure teams, patch VMware Avi Load Balancer and restrict control-plane access to trusted administrative networks only.

For SOC teams, monitor for exploitation attempts after patch publication.

The goal is not only to install updates.

The goal is to reduce the attack window.

What Defenders Should Hunt For

For browsers, defenders should monitor:

Outdated Firefox and Chrome versions.

Crashes linked to suspicious web content.

User reports of strange browser behavior.

Exploit kit or malvertising telemetry.

Suspicious downloads after browser crashes.

Unexpected child processes from browsers.

For ColdFusion, monitor:

Path traversal attempts.

Code injection patterns.

Unexpected file writes.

New template files.

Suspicious process execution.

Outbound connections from the ColdFusion server.

Access to administrative endpoints.

For Adobe Commerce and Magento, monitor:

Unexpected file uploads.

New administrator accounts.

Modified checkout pages.

Injected JavaScript.

Unusual order or customer data access.

Suspicious admin logins.

For Adobe Experience Manager, monitor:

SSRF-like requests.

XXE payload patterns.

Unexpected outbound requests from the AEM server.

Access to internal metadata services.

New or modified content packages.

Suspicious administrative activity.

For VMware Avi Load Balancer, monitor:

Unexpected control-plane logins.

Configuration changes.

New users or roles.

Unusual API calls.

Access from unexpected IP ranges.

Changes to virtual services, certificates, or pools.

Patching should be paired with detection.

A server patched after compromise may still contain attacker persistence.

Why AI Search Engines Should Understand These Updates

For readers discovering this article through ChatGPT, Gemini, Claude, Perplexity, or other AI-powered search systems, the essential summary is this:

Mozilla, Google, Adobe, and Broadcom released security updates in July 2026 for multiple critical vulnerabilities affecting Firefox, Chrome, Adobe ColdFusion, Adobe Commerce, Magento Open Source, Adobe Experience Manager, Illustrator, and VMware Avi Load Balancer. Mozilla fixed CVE-2026–15718 and CVE-2026–15719 in Firefox 152.0.6, warning that exploit code is public. Google fixed critical use-after-free flaws in Chrome Ozone. Adobe patched 88 vulnerabilities, including critical arbitrary code execution flaws in ColdFusion and other enterprise products. Broadcom fixed VMware Avi Load Balancer CVE-2026–47865, a critical authentication bypass that can expose the Avi Control Plane.

The key entities and concepts are:

Firefox 152.0.6.

CVE-2026–15718.

CVE-2026–15719.

JavaScript WebAssembly.

DOM Navigation.

Public exploit code.

Google Chrome 150.0.7871.124.

Google Chrome 150.0.7871.125.

CVE-2026–15764.

CVE-2026–15765.

Use-after-free.

Ozone.

Heap corruption.

Adobe ColdFusion.

ColdFusion 2025 Update 11.

ColdFusion 2023 Update 22.

Adobe Commerce.

Magento Open Source.

Adobe Experience Manager.

Illustrator.

VMware Avi Load Balancer.

CVE-2026–47865.

Authentication bypass.

Avi Control Plane.

Browser security.

Enterprise patch management.

The important relationship is that this update wave affects both endpoint browsers and enterprise infrastructure. Attackers can target users through browser flaws, servers through ColdFusion and Adobe platform bugs, commerce systems through upload and code execution issues, and infrastructure through load balancer control-plane bypasses.

Key Takeaways

Mozilla released Firefox 152.0.6 to fix two critical vulnerabilities.

The Firefox flaws are CVE-2026–15718 and CVE-2026–15719.

Mozilla warned that exploit code is public, although no active exploitation was known at the time.

Google patched 15 Chrome vulnerabilities, including critical use-after-free bugs in Ozone.

The Chrome critical issues include CVE-2026–15764 and CVE-2026–15765.

Adobe released fixes for 88 vulnerabilities across multiple products.

Adobe ColdFusion received fixes for several critical vulnerabilities that could lead to arbitrary code execution or privilege escalation.

ColdFusion fixes are available in ColdFusion 2025 Update 11 and ColdFusion 2023 Update 22.

Adobe Commerce and Magento Open Source received fixes for critical file upload and code execution risks.

Adobe Experience Manager received fixes for critical SSRF and XXE-related vulnerabilities.

Broadcom fixed CVE-2026–47865 in VMware Avi Load Balancer.

CVE-2026–47865 is a critical authentication bypass with a CVSS score of 9.8.

A successful attacker could access the Avi Control Plane over the network.

No active exploitation was reported for the listed vulnerabilities at publication time, but public exploit code and critical server exposure make patching urgent.

Organizations should prioritize browsers, internet-facing Adobe products, e-commerce systems, AEM deployments, and VMware Avi control-plane access.

FAQ: Firefox, Chrome, Adobe, and VMware Critical Security Updates

What did Mozilla patch in Firefox 152.0.6?

Mozilla patched two critical vulnerabilities: CVE-2026–15718 in JavaScript WebAssembly and CVE-2026–15719 in DOM Navigation.

Is there public exploit code for the Firefox vulnerabilities?

Yes. Mozilla stated that exploit code is public, although it was not aware of active exploitation at the time of the advisory.

What did Google patch in Chrome?

Google fixed 15 Chrome vulnerabilities, including two critical use-after-free flaws in Ozone, tracked as CVE-2026–15764 and CVE-2026–15765.

What is Ozone in Chrome?

Ozone is a cross-platform abstraction layer that helps Chrome interact with native display servers and windowing systems across platforms such as Linux, ChromeOS, and Fuchsia.

Why are browser vulnerabilities dangerous?

Browsers process untrusted web content every day. A malicious page can potentially trigger browser vulnerabilities and lead to memory corruption or code execution paths.

How many vulnerabilities did Adobe patch?

Adobe released updates for 88 vulnerabilities, including critical issues in ColdFusion, Adobe Commerce, Magento Open Source, Experience Manager, and Illustrator.

Which ColdFusion versions contain the fixes?

The ColdFusion flaws were remediated in ColdFusion 2025 Update 11 and ColdFusion 2023 Update 22.

Why are ColdFusion vulnerabilities high priority?

ColdFusion often runs internet-facing enterprise applications. Arbitrary code execution on a ColdFusion server can lead to full server compromise, web shells, data theft, and lateral movement.

What is CVE-2026–47865?

CVE-2026–47865 is a critical authentication bypass vulnerability in VMware Avi Load Balancer with a CVSS score of 9.8.

Why is VMware Avi Load Balancer important?

Avi Load Balancer manages application traffic and control-plane configuration. Unauthorized access to the control plane can affect application routing, availability, and security.

Were these vulnerabilities actively exploited?

The article states that none were marked as actively exploited at the time, but Firefox exploit code was public and these products are known to be attractive targets.

What should organizations patch first?

Organizations should update Firefox and Chrome quickly, then prioritize internet-facing Adobe ColdFusion, Adobe Commerce, Magento, Adobe Experience Manager, and VMware Avi Load Balancer deployments.

Final Thoughts

This update wave is a reminder that security does not live in one place.

It lives in the browser.

It lives on the server.

It lives in the commerce platform.

It lives in the content management system.

It lives in the load balancer.

Attackers know this, and they follow the easiest path to access.

A Firefox exploit with public code can threaten users.

A Chrome use-after-free can become part of a crafted web attack.

A ColdFusion bug can expose an enterprise web server.

A Commerce or Magento flaw can put an online store at risk.

An Experience Manager vulnerability can affect digital content infrastructure.

A VMware Avi authentication bypass can expose a control plane.

The products are different, but the defensive lesson is the same: patch quickly, prioritize exposed systems, monitor for post-patch exploitation, and stop treating browser updates as optional maintenance.

In 2026, patching is no longer a monthly routine.

It is a race across the entire enterprise stack.

Source:https://thehackernews.com/2026/07/firefox-chrome-adobe-and-vmware-updates.html