On October 22, 2026, Indian certificate authority eMudhra announced it will withdraw from the global SSL/TLS certificate business, five days after a researcher recovered the private keys of eight intermediate CA certificates — every one of them below 256. If your organization issues certificates under the emSign ECC Root CA - G3 root, you have until October 27 to move to another hierarchy.

The stable rollout of Chrome 154, which began September 22, 2026, closes 108 security flaws including 11 critical, almost all use-after-free and buffer-overflow bugs in the GPU and rendering layers. None is confirmed exploited, but their sandbox-escape potential makes them an immediate deployment priority across every browser in the fleet.

On September 8, 2026, Google ships Chrome 153, fixing 230 vulnerabilities including CVE-2026-87491, an out-of-bounds write in V8 already exploited in the wild. Update to 153.0.8010.36 or later before the CISA deadline of September 23, and check every Chromium browser in your fleet, Edge, Brave and Opera included.

On September 4, 2026, Google shipped an emergency Chrome update fixing CVE-2026-85046, a type confusion in the V8 engine already exploited in the wild and rated 8.8 on the CVSS scale. Update to Chrome 152.0.7977.82 or later and check every Chromium browser in your fleet, including Edge, Brave and Opera.

On August 3, 2026, Unit 42 (Palo Alto Networks) published three attacks dubbed Pass-ta-key that allow malware on a compromised Windows machine to hijack passkeys synced through Google Password Manager. The most severe, Golden Pass-ta-key, extracts the master encryption key from Chrome's memory and compromises all current and future passkeys on the victim's Google account.

On March 31, 2026, Google shipped an emergency patch for CVE-2026-5281, an already-exploited use-after-free in Dawn, Chromium’s WebGPU implementation. It’s Chrome’s fourth zero-day in four months — and a clear signal that low-level graphics APIs have become the browser exploitation frontier.