Palo Alto Networks released a patch for Prisma Browser to address multiple high-severity security flaws inherited from the Chromium engine.
Key points
- Prisma Browser versions 155.16.5 through 155.16.5.39 are vulnerable.
- The issues include cross-site request forgery and missing authorization.
- Palo Alto Networks is not aware of any active malicious exploitation.
Palo Alto Networks issued a high-severity advisory for its Prisma Browser product. The vendor released an update to address multiple security flaws inherited from the Chromium engine.
What happened
Palo Alto Networks published advisory PAN-SA-2026-0013 in October 2026. The notice covers a monthly vulnerability update for the Prisma Browser. The company incorporated several Chromium security fixes into its product release. These fixes address issues ranging from improper input validation to incorrect authorization. The flaws affect the Transactions Platform, DeviceBoundSessionCredentials, and Extensions. Other affected components include HttpsUpgrades, CredentialProvider, and Safebrowsing.
Additional issues involve CSS encoding, TrustedWebActivities, and Web Authentication. The advisory also cites problems in Accessibility, MediaStream, and PlatformIntegration. No special configuration is required for a system to be affected. The browser versions from 155.16.5 up to, but not including, 155.16.5.40 are vulnerable. Palo Alto Networks stated it is not aware of any malicious exploitation of this issue.
Why it matters
Browsers are complex applications that run many different services. When one part fails to check permissions correctly, attackers can sometimes bypass security controls. This incident highlights how flaws in the underlying engine can impact the entire application. Teams usually monitor vendor advisories to ensure their software remains secure. Checking whether your current version is listed in the advisory is a standard practice. Understanding the scope of the update helps prioritize remediation efforts. This guidance applies to any organization using browser-based tools in their workflow.
The fix
- Update Prisma Browser to version 155.16.5.40 or later.
- Verify that all endpoints have received the latest update.
- Check internal deployment logs to confirm patch status.
- Review browser extension policies for additional security.
Why it matters
Software vendors regularly release updates to fix security gaps. These updates often address multiple issues found in the underlying code. Users should treat these releases as important maintenance tasks. Ignoring updates can leave systems exposed to known weaknesses. Regular patching reduces the attack surface for potential threats. This approach helps maintain a secure environment for all users. It is a fundamental part of managing digital tools effectively.
Background: Input validation
Input validation fails when developers treat it as a final gate rather than a continuous constraint. You must validate data at every boundary, enforce strict type checking, and separate parsing from processing. Security regression testing helps catch when new features break these rules.
Read the full guide: Input Validation Errors: 6 Misconceptions Blocking Your Security
What to do and how to stay safe: Palo Alto Networks
- Check your current Prisma Browser version against the vulnerable range.
- Deploy the latest update to all affected devices as soon as possible.
- Monitor for any unusual browser behavior after updating.
- Review your organization's patch management procedures for future updates.
Step-by-step guide: Patch Testing: How to Verify Fixes Without Breaking Your Systems
General security guidance from the Crypt Weekly newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Prisma Browser versions are affected?
Versions from 155.16.5 up to, but not including, 155.16.5.40 are vulnerable.
Is this issue being exploited in the wild?
Palo Alto Networks is not aware of any malicious exploitation of this issue.
What is the severity of this advisory?
The advisory is rated as high severity with a CVSS-BT score of 7.7.
