Palo Alto says Prisma Browser needs Chromium fixes (PAN-SA-2026-0014)

What happened

According to the Palo Alto Networks PSIRT advisory PAN-SA-2026-0014, published on 2026-11-11, the company “incorporated the following Chromium security fixes into our products” and the advisory is titled a monthly Chromium vulnerability update for November 2026. Palo Alto PSIRT The advisory points to several Chrome stable channel desktop update posts from Google as the origin of the fixes. It says the issue was discovered externally. Palo Alto PSIRT

Palo Alto Networks lists a long set of CVEs covering Chromium components. Examples from its table include use after free in V8 (CVE-2026-110168), type confusion in V8 (CVE-2026-110140), a buffer overflow in ANGLE (CVE-2026-110152) and privilege elevation in Installer (CVE-2026-110150). Palo Alto PSIRT

The vendor rates the advisory severity HIGH with a suggested urgency of MODERATE. It gives a CVSS-BT score of 7.7 and a CVSS-B score of 9.4. Palo Alto PSIRT Palo Alto Networks says it is not aware of any malicious exploitation, and lists exploit maturity as unreported. Palo Alto PSIRT

Not confirmed in the source: which of the listed CVEs, if any, are exploited in the wild, and any technical detail beyond the one-line component descriptions.

Am I affected?

According to the advisory, the only product listed is Prisma Browser. The advisory’s status table shows versions below 155.16.6.80 as affected and 157.19.4.39 or later as unaffected. A CPE entry in the same advisory marks Prisma Browser from 157.19.4 up to (excluding) 157.19.4.39 as vulnerable. Palo Alto PSIRT Palo Alto Networks says no special configuration is required to be affected. Palo Alto PSIRT

Each CVE maps to its own fixed build. For example, the vendor lists 155.16.6.80 for CVE-2026-110136 through CVE-2026-110172, 155.16.7.85 for CVE-2026-110913 through CVE-2026-110922, and 157.19.4.39 for CVE-2026-121166 and four other CVEs. Palo Alto PSIRT

Other Palo Alto Networks products, and other Chromium-based browsers, are not mentioned in the advisory. Their status is not confirmed.

What to do now

1. Check which Prisma Browser version is deployed in your environment.
2. Update Prisma Browser to 157.19.4.39 or later, which the advisory lists as unaffected. The advisory’s per-CVE table shows the lower fixed builds (155.16.6.80, 155.16.7.85, 156.17.7.48, 156.17.8.74, 156.17.9.80) for individual CVEs. Palo Alto PSIRT
3. Do not rely on a workaround: Palo Alto Networks says no known workarounds exist. Palo Alto PSIRT
4. Read the full per-CVE table in the vendor advisory and follow its updates, since the source gives only the initial publication on 2026-11-11.

Sources

• Palo Alto PSIRT: PAN-SA-2026-0014 Chromium: Monthly Vulnerability Update (November 2026)