The UpdateStar Vulnerability Index — June 2026

Quick note before we start: every app mentioned in this report has a page on UpdateStar where you can check the current version, read the changelog, and download the latest release — links are inline throughout. If you'd rather have one tool watch all of this automatically, scroll to the bottom for our recommendation.

Here you can find the current UpdateStar Vulnerability Index.

TL;DR

June was a rough month. The five most widely-installed consumer apps carrying open or freshly-patched CVEs are Google Chrome, Adobe Acrobat Reader, 7-Zip, WinRAR, and Mozilla Firefox — and at least three of them have confirmed, active exploitation in the wild right now.

The most dangerous app on your PC this month isn't some obscure utility. It's almost certainly Google Chrome, sitting on roughly 3.83 billion devices with an actively-exploited V8 zero-day that was added to CISA's Known Exploited Vulnerabilities catalog on June 9. The fix has been out for two weeks. Millions of people haven't applied it yet because they haven't restarted their browser.

The structural story behind all of this: patching is losing the race. Mandiant's M-Trends 2026 found that the mean time-to-exploit is now negative seven days — attackers routinely strike before a patch even ships. And yet Verizon's 2026 DBIR reports organizations take a median of 43 days to remediate known-exploited vulnerabilities, with only 26% of CISA KEV flaws fully fixed. That gap is the ballgame.

The Top 5 — June 2026

🔴 #1 — Google Chrome · This Month's Spotlight: Most Dangerous Unpatched App

→ Check your Chrome version and update on UpdateStar

CVE: CVE-2026-11645 CVSS: 8.8 (High) Status: Patched June 8, 2026 · Confirmed exploitation in the wild · On CISA KEV

Chrome's V8 JavaScript engine has had a rough 2026. CVE-2026-11645 — an out-of-bounds read/write — is the fifth actively-exploited Chrome zero-day of the year, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, and CVE-2026-5281. An anonymous researcher (bug bounty: $55,000) reported it April 27; Google patched it June 8 in Chrome 149.0.7827.102/.103. The fix is out there. The problem is that Chrome's update only takes effect after a browser restart, and plenty of people leave Chrome running for days or weeks at a time.

The blast radius here is hard to overstate. Chrome has an estimated 3.83 billion users in 2026, plus a ~68% global browser market share. The same V8 vulnerability flows through every Chromium-based browser: Microsoft Edge, Brave, Opera, Vivaldi — and every Electron app on your desktop. If it runs on Chromium, it has this hole until updated.

What to do: Open chrome://settings/help right now and confirm you're on 149.0.7827.102 or later. Then restart. Seriously, restart the browser. Edge, Brave, and Opera users: force-update your respective browser too.

Considering alternatives? UpdateStar's Chrome alternatives comparison covers Brave, Firefox, Vivaldi, and others — though be aware that most share the same Chromium V8 engine.

🔴 #2 — Adobe Acrobat Reader

→ Check your Acrobat version and update on UpdateStar

CVE: CVE-2026-34621 (plus bypass patch CVE-2026-34622) CVSS: 8.6 (originally 9.6 before Adobe revised the attack vector) Status: Patched · Confirmed exploitation in the wild · On CISA KEV since April 13

This one had been quietly exploited for months before anyone noticed. CVE-2026-34621 is a prototype-pollution flaw in Acrobat's embedded JavaScript engine — open a malicious PDF, and the attacker gets code execution. Samples spotted in the wild were fingerprinting machines (OS, version, language) and exfiltrating data to attacker-controlled servers. Adobe patched it, then had to patch the patch after CVE-2026-34622 was filed when the first fix was bypassed.

The June bulletin (APSB26-63, June 9) fixed additional critical RCE bugs in 26.001.21662 and later — Adobe says no known exploitation for those yet, but given the pattern with this software, "not yet" is worth taking seriously.

What to do: Open Acrobat, go to Help → Check for Updates. You want to be on 26.001.21662 or later after the June patch. If you're on Acrobat 2024, the target is 24.001.30383 or later.

Worth considering: If you only need to read PDFs — not edit, sign, or use cloud features — there are lighter alternatives with smaller attack surfaces. UpdateStar's Adobe Reader alternatives page compares SumatraPDF, Foxit PDF Reader, PDF-XChange Viewer, and others. SumatraPDF in particular is extremely minimal and has a strong security track record.

🟠 #3 — 7-Zip

→ Check your 7-Zip version and update on UpdateStar

CVE: CVE-2026-48095 CVSS: 8.8 (some sources list 7.8 — the discrepancy is noted below in caveats) Status: Patched in 7-Zip 26.01 (April 27) · Public PoC available · No confirmed in-the-wild exploitation yet

This is the one that worries me most for the average home user, not because it's being exploited right now, but because it's the kind of vulnerability that spreads silently. A heap buffer write overflow in 7-Zip's NTFS archive handler: due to a 32-bit arithmetic error, a 1-byte allocation can receive up to 256 MB of attacker-controlled data. The practical upshot is that simply opening a crafted archive — or even having your antivirus scan one — could trigger code execution. And because 7-Zip uses signature-based content detection, the malicious file doesn't need to have a .7z or .zip extension. Name it anything.

GitHub Security Lab researcher Jaroslav Lobačevski privately reported this April 24. Fixed in 7-Zip 26.01 three days later. Public advisory GHSL-2026-140 dropped May 22 once patches had circulated — and a public proof-of-concept followed, which lowers the bar for less-sophisticated attackers considerably.

7-Zip has no auto-update. None. You have to go manually get the new version, and plenty of people never do. This is compounded by the fact that 7z libraries are embedded in third-party tools — AV engines, backup software, log processors — that often run with elevated privileges and may never get updated even when the standalone app does.

What to do: Download 7-Zip 26.01+ directly from UpdateStar and install it over your old version. If you manage Linux machines, audit your p7zip packages — many distro repos are running outdated versions.

🟠 #4 — WinRAR

→ Check your WinRAR version and update on UpdateStar

CVE: CVE-2025-8088 (CVSS 8.4 per NVD, 8.8 per some vendors; see caveats) Status: Patched in WinRAR 7.13 — July 2025 · Still being actively exploited · On CISA KEV

Yes, this patch is almost a year old. It's on the list because the exploitation is still happening — aggressively — and because WinRAR has no auto-update mechanism, meaning a substantial fraction of its hundreds of millions of users are still running the vulnerable version.

The flaw: path traversal via crafted RAR archives using NTFS Alternate Data Streams, which lets attackers drop files directly into the Windows Startup folder. Once the archive is opened, nothing else needs to happen — the malicious file runs at next boot. Google's GTIG, Trend Micro, and ESET have all documented continued exploitation through June 2026 by a who's-who of state actors: RomCom, Sandworm (APT44), Turla, Gamaredon, Chinese actors delivering Poison Ivy, and at least two more groups. New exploit samples were built as recently as April 2026.

This is the textbook case of why a "patched" vulnerability still belongs in a consumer threat index. The patch exists. Most users haven't applied it, because they'd have to go find it themselves.

What to do: Download WinRAR 7.13+ from UpdateStar and install it. If you haven't updated WinRAR in more than a year, assume you're vulnerable and prioritize this today.

UpdateStar's data shows over 128,000 UpdateStar client users had WinRAR installed last month — which is a meaningful signal of how widely deployed this software remains on Windows machines.

🟡 #5 — Mozilla Firefox

→ Check your Firefox version and update on UpdateStar

CVEs: June quarterly rollup (MFSA 2026-57/58/59) — Firefox 152, ESR 140.12, ESR 115.37 Status: Patched · No confirmed in-the-wild exploitation

Firefox's June rollup addresses memory-safety bugs including a WebGPU buffer overflow (CVE-2026-5733) and a JIT use-after-free (CVE-2026-2766). No confirmed exploitation in the wild, and Firefox's auto-update mechanism is generally reliable — this is more a "make sure auto-update actually ran" situation than an emergency.

The more notable Firefox story this month is actually the AI connection: Anthropic's Claude Mythos model was credited with finding 271 vulnerabilities patched in Firefox 150, with three receiving public CVEs (CVE-2026-6746, CVE-2026-6757, CVE-2026-6758). It's a glimpse of what AI-assisted security research is starting to do to CVE volume across the board.

What to do: Open Firefox, go to Help → About Firefox. If auto-update is working, you should already be on 152.0 or later. If not, the UpdateStar page will show you the latest available version.

Honorable Mentions

Microsoft (Patch Tuesday, June 9): A record-breaking release. ZDI counted 208 CVEs in this single Patch Tuesday — the largest monthly Microsoft release since 2017, driven partly by AI-assisted bug discovery. One actively-exploited CVE: CVE-2026-41091 (Defender elevation of privilege). The headliner for IT teams is CVE-2026-45657 (Windows Kernel TCP/IP, CVSS 9.8, wormable, no user interaction required) — not confirmed exploited yet, but the kind of bug that makes network admins lose sleep. Three publicly-disclosed zero-days: CVE-2026-45586 (CTFMON), CVE-2026-49160 (HTTP/2 Bomb DoS), and CVE-2026-50507 (BitLocker bypass).

Zoom: CVE-2026-30903 (Critical, unauthenticated privilege escalation in Workplace for Windows Mail) was patched in March in version 6.6.0. No in-the-wild exploitation reported, but given Zoom's enterprise penetration, it's worth checking if your organization's deployment is current.

The Patch-Lag Picture

Here's the number that should change how you think about this:

The mean time-to-exploit is now -7 days. That's from Mandiant's M-Trends 2026. Attackers are, on average, exploiting vulnerabilities before patches are released. Meanwhile, Verizon's 2026 DBIR (drawing from 13,000+ organizations) finds that median KEV remediation takes 43 days, up from 32 days last year — and only 26% of known-exploited vulnerabilities were fully remediated, down from 38%.

The math doesn't work in defenders' favor. But there's a meaningful difference between software that auto-updates silently (Chrome, Firefox, Defender) and software that requires the user to manually go find and install a new version (7-Zip, WinRAR). Every app in category two that you have installed is a liability that requires active management.

The Honest Recommendation: Use the UpdateStar Client

I've been writing about software security for a while, and the single most practical thing most Windows users can do — beyond enabling auto-update wherever it exists — is install a tool that watches the rest.

→ Download the UpdateStar Client for Windows

The UpdateStar client monitors your installed software, checks it against UpdateStar's database of 1.8 million+ indexed titles, and notifies you when updates are available. It covers the exact category-two problem described above: the 7-Zips and WinRARs of the world that will never tell you they need updating. The Premium Edition adds CVE-level risk assessments for your installed apps, tracks minor version updates often missed by standard monitors, and validates download sources — useful if you want to know not just that an update is available but why it matters from a security standpoint.

It's the most pragmatic answer to a world where the patch window is shorter than ever and the update burden on users keeps growing.

Caveats and Methodology

• CVSS scores diverge across sources. 7-Zip's CVE-2026-48095 is listed as 8.8 by some trackers and 7.8 by others; WinRAR's CVE-2025-8088 appears as both 8.4 (NVD) and 8.8 (some vendors); Adobe revised CVE-2026-34621 from 9.6 to 8.6 after updating the attack vector. Where discrepancies exist, we note the range.
• Microsoft's June CVE count is genuinely disputed. BleepingComputer reported ~200, Tenable 198, CyberScoop 206, ZDI 208. We use ZDI's 208 as the cited figure.
• Install base figures for desktop utilities (7-Zip, WinRAR) are vendor/download estimates, not audited active-user counts. The UpdateStar client data (e.g. "128,000 users checked WinRAR last month") reflects UpdateStar's own client telemetry and is a directional signal, not a global census.
• AI is inflating raw CVE numbers. Several 2026 records are partly attributable to AI-assisted discovery (Claude Mythos for Firefox, Codex for Microsoft HTTP/2). CVE volume is up partly because detection improved — read the record counts with that context.
• This index is editorial, not a complete vulnerability database. Always verify against NVD, the CISA KEV catalog, and vendor advisories before acting in a professional or enterprise context.

*The complete UpdateStar Vulnerability Index.

David Fischer is a technology writer with a background in software security and systems administration. This report is published monthly by UpdateStar as part of the UpdateStar Vulnerability Index series.

→ All software pages, version checks, alternatives comparisons, and the UpdateStar client download are available at updatestar.com.