Key points
- Flaws include CSRF and missing authorisation in multiple browser components.
- Versions 155.16.5 up to 155.16.5.40 are vulnerable to remote attacks.
- Palo Alto Networks states no malicious exploitation is currently known.
An attacker can exploit flaws in Prisma Browser to bypass authorisation or transmit sensitive data in cleartext. The vendor confirms that versions 155.16.5 through 155.16.5.39 are affected. These issues allow remote attackers with low complexity to achieve high impact on confidentiality, integrity and availability. No special configuration is required for the flaws to be active.
In plain English
The browser fails to correctly validate input or enforce security policies in several areas. This includes how it handles transactions, extensions and web authentication. Sensitive data may also be sent in cleartext. These errors mean the browser trusts malicious input or fails to block unauthorised actions, allowing attackers to bypass standard security checks.
The background
Palo Alto Networks integrated Chromium fixes from September and October 2026 into its products. The advisory lists multiple bug classes, including improper input validation and incorrect type conversion. The CVSS base score is 9.4, while the temporal score is 7.7. The vendor is not aware of any active malicious exploitation of these issues.
What changes now
Users must update Prisma Browser to version 155.16.5.40 or later. This update incorporates the necessary Chromium security patches. The vendor has not provided a workaround for older versions. Teams should verify their current version immediately to ensure they are not running vulnerable builds.
The attacker's path
Attackers typically exploit these flaws to gain initial access or escalate privileges within a network. They rely on the browser’s failure to validate requests or enforce authorisation rules. This often serves as a foothold for further intrusion, allowing lateral movement or data exfiltration. Teams usually monitor for unusual session activity or unauthorised extension installations. Check whether your endpoints are enforcing strict browser policies to limit exposure.
What to do and how to stay safe: Palo Alto Networks
- Verify the installed Prisma Browser version on all managed endpoints.
- Deploy version 155.16.5.40 or later to all affected systems.
- Monitor logs for signs of unauthorised session activity or CSRF attempts.
- Review extension policies to ensure only trusted add-ons are permitted.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Prisma Browser versions are vulnerable?
Versions from 155.16.5 up to, but not including, 155.16.5.40 are vulnerable.
Is there evidence of active exploitation?
Palo Alto Networks states it is not aware of any malicious exploitation.
What is the severity of these flaws?
The CVSS base score is 9.4, rated as high severity by the vendor.
