The UpdateStar Vulnerability Index — September 2026

A Chrome-to-Windows zero-day chain used by China-linked hackers, a record-breaking Microsoft Patch Tuesday, and WinRAR's 14-month-old hole still under attack: the five most widely installed consumer apps with open or newly patched CVEs this month are Google Chrome, Microsoft Windows, WinRAR, Mozilla Firefox, and 7-Zip.

Quick note before we start: every app mentioned in this report has a page on UpdateStar where you can check the current version, read the changelog, and download the latest release. Links are inline throughout. If you'd rather have one tool watch all of this automatically, scroll to the bottom for our recommendation.

Here you can find the current UpdateStar Vulnerability Index.

As a reminder, you can make this site as preferred source by clicking here.

TL;DR

September 2026 is the worst month of the year so far, and the Index climbs to 82 out of 100 (SEVERE), up from 70 in August. Two Chinese espionage groups were caught chaining two Chrome zero-days and one Windows zero-day: open a web page in an unpatched browser, and they end up with full SYSTEM control of the PC. All three bugs are now on CISA's Known Exploited Vulnerabilities list. A week later, Microsoft shipped the largest Patch Tuesday in its history, about 964 CVEs, more than double August's count. It included a second exploited Windows zero-day and 20 bugs that security researchers consider potentially wormable.

The structural story hasn't changed. Mandiant's M-Trends 2026 puts the mean time-to-exploit at negative seven days, and this month's Chrome chain is a textbook case. Verizon's 2026 DBIR finds organizations take a median of 43 days to fix known-exploited vulnerabilities, and only 26% of CISA KEV flaws are fully remediated.

The Top 5 — September 2026

🔴 #1 — Google Chrome · This Month's Spotlight: Two Zero-Days, One Exploit Chain

→ Check your Chrome version and update on UpdateStar

| CVE | CVE-2026-85046 / CVE-2026-87491 | | CVSS | 8.8 (High) | | Status | Patched September 3 and September 8, 2026 · Confirmed exploitation in the wild · Both on CISA KEV |

Google patched two actively exploited Chrome zero-days within five days of each other. They are the sixth and seventh of 2026, and it turns out they were being used together. CVE-2026-85046 is a type confusion bug in V8, Chrome's JavaScript engine, that gives an attacker read/write access to the browser's memory. CVE-2026-87491 is an out-of-bounds write, also in V8, that breaks out of V8's own internal sandbox.

According to Volexity, two China-linked groups, UTA0560 and JungleBamboo, used both bugs as the first stages of a single chain starting September 1. The targets were NGOs, reached through spear-phishing emails. One group dropped a backdoor called GRIMWEDGE; the other installed a malicious Chrome extension. Volexity says the attackers took advantage of the "patch gap": the window after fixes land in the open-source Chromium code but before they reach the Chrome build on your computer.

The same Chrome 153 release that fixed the second zero-day also closed 230 vulnerabilities in total, five of them rated Critical.

What to do: Open chrome://settings/help, confirm you're on 153.0.8010.36 or later, and restart the browser. The fix does nothing until you relaunch. The same applies to Edge, Brave, Opera, and Vivaldi, which share Chrome's engine.

🔴 #2 — Microsoft Windows (ALPC)

| CVE | CVE-2026-85880 | | CVSS | 7.8 (High) | | Status | Patched September 8, 2026 · Confirmed exploitation in the wild · On CISA KEV |

This is the third link in the chain above. CVE-2026-85880 is a heap buffer overflow in Windows' Advanced Local Procedure Call (ALPC), the kernel mechanism Windows processes use to talk to each other. Chrome runs web content in a locked-down sandbox, and this bug is what let the attackers escape that sandbox and go straight to SYSTEM, the highest privilege level on the machine. It is the first ALPC zero-day since January 2023.

It wasn't Microsoft's only exploited bug this month. CVE-2026-81963, a link-following flaw in the Windows Update Stack (CVSS 7.8), was also exploited as a zero-day and patched on the same day. It is the first Update Stack vulnerability ever flagged that way.

What to do: Run Windows Update and install the September 2026 cumulative update. This fix comes through Windows Update only; there is no separate download page.

🔴 #3 — WinRAR

→ Check your WinRAR version and update on UpdateStar

| CVE | CVE-2025-8088 | | CVSS | 8.4 (High) | | Status | Patched in WinRAR 7.13 (July 2025) · Still under active nation-state exploitation · On CISA KEV |

This is the fourth month in a row this bug has made our Top 5. Google's Threat Intelligence Group calls exploitation "widespread and ongoing." Trend Micro is tracking two separate Russia-aligned campaigns (SHADOW-EARTH-066 and Earth Dahu/Gamaredon) that are still producing new exploit samples against Ukrainian organizations. A crafted RAR archive quietly drops a file into the Windows Startup folder, and the payload runs at the next login.

The fix has existed for 14 months. The problem is that WinRAR has no auto-update, and roughly 500 million people use it.

What to do: Download WinRAR 7.13 or later from UpdateStar. If you haven't manually updated WinRAR in the last year, assume you're vulnerable.

🟠 #4 — Mozilla Firefox

→ Check your Firefox version and update on UpdateStar

| CVE | MFSA 2026-82 — Firefox 155 | | CVSS | High (Mozilla impact rating) | | Status | Patched September 1, 2026 · No confirmed in-the-wild exploitation |

Firefox 155 fixes 29 security issues, 10 of them rated high. The most serious are two sandbox escapes caused by use-after-free bugs in the DOM Navigation and DOM Security components, plus a privilege escalation in WebGPU. Mozilla's usual bundles of internally found memory-safety bugs are also rated high, with the standard note that some "could have been exploited" with enough effort. There's no sign of real-world attacks, and Firefox's auto-update is reliable.

What to do: Help → About Firefox. You should already be on 155.0 or later if auto-update ran.

🟡 #5 — 7-Zip · Good News This Month: The Fix Is Here

→ Check your 7-Zip version and update on UpdateStar

| CVE | CVE-2026-58052 | | CVSS | 4.8 (Medium) | | Status | Fixed in 7-Zip 26.03 (early September 2026) · No auto-update |

Last month we warned that this Mark-of-the-Web bypass had no fix at all. That has changed. A crafted RAR5 archive can erase the tag Windows uses to flag files downloaded from the internet, which silently disables SmartScreen warnings. 7-Zip 26.03 now lists the bug as fixed, a little over two months after it was disclosed.

The catch hasn't changed: 7-Zip doesn't update itself. The fix only helps if you install it.

What to do: Download 7-Zip 26.03 from UpdateStar and replace any older version, especially on machines that open archives from email or the web.

Honorable Mentions

Microsoft (Patch Tuesday, September 8): This is the largest Patch Tuesday on record, beating July's 569. Counts range from 964 (Tenable) to 974 (SecurityWeek) depending on methodology, with 104 rated Critical. The highest score goes to a Windows DNS Server remote-code-execution bug, CVE-2026-69730, at 9.8, which researchers compare to 2020's "SigRed". A Remote Desktop Services RCE (CVE-2026-69525) also scores 9.8.

Adobe Acrobat Reader (APSB26-141, September 8): Adobe fixed critical code-execution flaws. It says it isn't aware of any exploits in the wild, but it's worth updating via Help → Check for Updates.

The Patch-Lag Picture

This month shows both sides of the patch-lag problem. The Chrome chain went from Google receiving the bug reports to attacks in the wild in about four weeks, and the attackers moved before most users had the fix. Meanwhile, the WinRAR fix has been available for more than 420 days and attackers are still getting in, because nobody updated.

The difference between software that updates itself and software you have to remember to update is still what decides who gets hit. Windows, Chrome, and Firefox all patch themselves and only need a restart. WinRAR and 7-Zip don't, even when a fix exists.

The Honest Recommendation: Use the NEW UpdateStar 16 Client

Beyond turning on auto-update wherever it exists, the single most practical thing most Windows users can do is install a tool that keeps an eye on the software that won't update itself.

→ Download the UpdateStar Client for Windows

The UpdateStar client checks your installed software against UpdateStar's database and tells you when updates are available. That covers exactly the apps that never announce they need attention, like WinRAR and 7-Zip. The Premium Edition adds CVE-level risk context for your installed apps.

Caveats and Methodology

• Microsoft's September CVE count differs by tracker: Tenable reports 964 and SecurityWeek 974. We cite ~964.
• Google rates CVE-2026-87491 as Medium severity; the CVSS 8.8 score shown here comes from the published vector and should be treated as provisional until NVD finalizes it.
• The 7-Zip fix status is based on the 26.03 changelog; the original SourceForge bug ticket was still marked open at time of writing.
• Install base figures are based on vendor figures or estimates, not audited active-user counts.
• This index is an editorial selection, not a complete vulnerability database. Always verify against NVD, the CISA KEV catalog, and vendor advisories before acting in a professional or enterprise context.

The complete, continuously updated UpdateStar Vulnerability Index is available at client.updatestar.com.

This report is published monthly by UpdateStar as part of the UpdateStar Vulnerability Index series.

→ All software pages, version checks, alternatives comparisons, and the UpdateStar client download are available at updatestar.com.