April 2026 Third-Party Vulnerabilities and Patches 

This April was the most active month observed so far in terms of third‑party vulnerability disclosures and remediation activity. During the month, 360 unique vulnerabilities were identified across 96 applications, with vendors releasing 172 patched versions to address these issues. Compared to earlier months, April represents a clear peak in both vulnerability volume and patch output, continuing and amplifying the upward trend seen earlier in the year. 

The high vulnerability count in April is primarily driven by a small number of widely deployed products receiving very large security‑focused updates, where a single version remediated dozens of vulnerabilities. As shown in the data in the bottom of this blog, multiple browser releases addressed between 60 and 64 vulnerabilities in one update, including Microsoft Edge (Beta and Business), Google Chrome (standard, Business, and Education builds), Brave Browser, and Vivaldi. Mozilla products also contributed significantly, with Firefox 150.0 remediating 41 vulnerabilities and Thunderbird 150.0 addressing 40 vulnerabilities in single releases. 

Notable vulnerabilities in April 2026 third-party patches 

Several vulnerabilities disclosed and patched in April 2026 stand out due to confirmed exploit availability and widespread product exposure. In particular, CVE–2026–34621, CVE-2026-5281, and CVE–2025–6965 merit additional attention, as all three have either been actively exploited in the wild or have publicly available proof‑of‑concept exploits. Their inclusion in high‑impact products and libraries significantly shortens the safe remediation window for affected organizations. 

CVE–2026–34621 is a high‑severity vulnerability in Adobe Acrobat and Acrobat Reader caused by improper handling of JavaScript object prototype attributes, leading to a prototype pollution condition. Successful exploitation allows arbitrary code execution in the context of the current user when a victim opens a specially crafted malicious PDF file. Adobe has confirmed that this vulnerability was actively exploited in the wild prior to patch availability, and it has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. While exploitation requires user interaction, Acrobat and Reader’s broad deployment across enterprise and consumer environments makes this vulnerability particularly impactful. Additional details and fixed versions are documented in Adobe’s official security bulletin and release notes, with KEV status published by CISA. 

CVE–2026–5281 is a high‑severity use‑after‑free vulnerability in Google Chrome’s Dawn component, which implements WebGPU functionality. The flaw can be triggered via a crafted HTML page once an attacker has compromised the browser’s renderer process, enabling arbitrary code execution within the browser context. Google has confirmed that an exploit for this vulnerability exists in the wild, and it was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog on April 1, 2026, classifying it as a zero‑day at the time of disclosure. Due to Chromium’s shared codebase, this vulnerability also affects other Chromium‑based browsers such as Microsoft Edge, Brave, and Vivaldi until patched downstream. Organizations should treat this issue as high‑priority and ensure all Chromium‑based browsers are fully up to date. 

CVE–2025-6965 is a critical memory corruption vulnerability in SQLite, caused by improper handling of aggregate terms exceeding available columns. This vulnerability was published on July 15, 2025. It was originally discovered by Google’s Big Sleep. The vulnerability resurfaced in this blog because it seems that it was only now patched in Microsoft Visual Studio. Under certain conditions, this flaw can result in out-of-bounds memory access, potentially leading to crashes or arbitrary code execution. 
 

Browser security updates in April 2026 

Browser updates were a major contributor to April’s vulnerability volume, with several browsers receiving multiple releases remediating large numbers of vulnerabilities per version. Chromium‑based browsers in particular account for the highest counts, driven by upstream Chromium security fixes that propagate across multiple vendors and distribution channels. Mozilla browsers also shipped large security updates, including both standard and ESR releases. 

Microsoft product updates included in April 2026 third-party patches 

Microsoft issued security updates for several other products: 

• Microsoft .NET Runtime 10.0 
• Microsoft .NET Runtime 8.0 
• Microsoft .NET Runtime 9.0 
• Microsoft .NET SDK 10.0 
• Microsoft .NET SDK 8.0 
• Microsoft .NET SDK 9.0 
• Microsoft 365 Apps 
• Microsoft ASP.NET Core Runtime 10.0 
• Microsoft ASP.NET Core Runtime 8.0 
• Microsoft ASP.NET Core Runtime 9.0 
• Microsoft ASP.NET Core Runtime Hosting Bundle 10.0 
• Microsoft ASP.NET Core Runtime Hosting Bundle 8.0 
• Microsoft ASP.NET Core Runtime Hosting Bundle 9.0 
• Microsoft Azure CLI 
• Microsoft Edge Beta 
• Microsoft Edge for Business 
• Microsoft Project 
• Microsoft Visio 
• Microsoft Visual Studio 2022 Community 
• Microsoft Visual Studio 2022 Enterprise 
• Microsoft Visual Studio 2022 Professional 
• Microsoft Visual Studio Code 
• Microsoft Visual Studio Team Explorer 2022 
• Microsoft Windows Desktop Runtime 10.0 
• Microsoft Windows Desktop Runtime 8.0 
• Microsoft Windows Desktop Runtime 9.0 

Detailed list of April third-party patches 

Application management at the speed of your operations 

Vulnerabilities move fast, especially in a distributed workforce. Discover how Recast’s application management product, Application Workspace, helps IT teams keep applications patched, compliant, and correctly configured, wherever work happens.