June 2026 Third-Party Vulnerabilities and Patches 

June 2026 was by far the most active month observed in our dataset to date. During the month, 1,302 unique vulnerabilities were identified across 83 applications, while vendors released 161 patched versions to address these issues. This represents a substantial increase from May, which saw 645 vulnerabilities across 80 applications and 124 released versions. Looking at the historical trend data, June stands out as a clear outlier, with the number of newly disclosed vulnerabilities more than doubling month over month while the number of affected applications remained relatively stable. 

The dramatic increase in June’s vulnerability count can largely be attributed to an exceptionally active month for Chromium-based browsers and related projects. According to Google’s June security releases, Chrome 149 included 429 security fixes, while Chrome 150 included another 433 security fixes. In addition, other Chrome for Business releases in the same data set accounted for further fixes, bringing the reviewed Chrome-related total to 967 security fixes. Because Chromium fixes are inherited by multiple downstream browsers, including Microsoft Edge, Brave, Opera, and Vivaldi, a single upstream disclosure cycle can result in hundreds of vulnerabilities being remediated across multiple products and release channels. 

One notable pattern in this Chrome release is that the overwhelming majority of disclosed vulnerabilities were reported internally by Google rather than by external researchers. In this dataset of 967, more than 80% of CVEs were attributed to Google. This may indicate that Google’s internal security discovery processes are becoming significantly more effective. Given public reports that Google was among the organizations participating in Anthropic’s Mythos-related Project Glasswing initiative, AI-assisted vulnerability discovery is a plausible contributing factor. Still, the release notes do not explicitly state that Mythos was used for these findings, so this should be treated as an informed hypothesis rather than a confirmed fact. Meanwhile, Mozilla has shared concrete evidence that harnessing Claude Mythos in its pipelines has greatly increased the number of security bugs found. See the blog written by its Tech Lead and Principal Engineer. It would be a surprise if Google wasn’t doing the same. 

Notable vulnerabilities in June third-party patches 

While this month included hundreds of disclosed vulnerabilities, three stand out due to the combination of exploit availability and elevated Exploit Prediction Scoring System (EPSS) values. 

CVE-2026-20253 is a critical Splunk Enterprise vulnerability that allows an unauthenticated attacker to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint that lacks authentication controls. The vulnerability has been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog, and Splunk has confirmed limited real-world exploitation. It also has an elevated EPSS score of 88.17%. Organizations running vulnerable Splunk Enterprise versions should prioritize remediation immediately. More information can be found in the advisory from Splunk. 

CVE-2025-6965 (EPSS: 73.50%) is a high-severity memory corruption vulnerability in SQLite that affects versions prior to 3.50.2. The flaw can occur when the number of aggregate terms exceeds the available column count, leading to a numeric truncation issue and potential memory corruption. Notably, the vulnerability was discovered by Google’s Threat Analysis Group with assistance from Google’s Big Sleep project, highlighting the growing role of AI-assisted vulnerability discovery. The vulnerability has now been fixed in various versions of Microsoft Visual Studio. 
 
CVE-2026-11645 is a high-severity Chrome zero-day vulnerability involving an out-of-bounds read/write issue in the V8 JavaScript engine. Successful exploitation can enable arbitrary code execution through a crafted web page. Google acknowledged that an exploit exists in the wild, and the vulnerability was added to CISA’s KEV catalog. The vulnerability affects Google Chrome versions prior to 149.0.7827.103 and has been fixed in version 149.0.7827.103 and later. More information can be found on Chrome Releases. 

Browser Security Updates in June 2026 

Browser updates were the dominant driver of vulnerability activity during the month. Google Chrome alone accounted for 967 security fixes across seven releases, making Chromium the largest single source of disclosed vulnerabilities during the reporting period. The most significant updates were Chrome 149 and Chrome 150, which together addressed 862 security issues. Because Chromium serves as the foundation for multiple browsers, including Microsoft Edge, Brave, Opera, and Vivaldi, many of these vulnerabilities also appeared in downstream browser releases. As a result, the vulnerability counts reported by individual Chromium-based browsers should not be treated as unique findings, but rather as evidence of how a single upstream security release can drive remediation activity across the broader browser ecosystem. Mozilla products remained comparatively stable, with Firefox releases accounting for a much smaller share of browser-related vulnerability activity. 

Microsoft product updates included in June 2026 third-party patches 

Microsoft issued security updates for several other products: 

• Microsoft .NET Runtime 10.0 
• Microsoft .NET Runtime 8.0 
• Microsoft .NET Runtime 9.0 
• Microsoft .NET SDK 10.0 
• Microsoft .NET SDK 8.0 
• Microsoft .NET SDK 9.0 
• Microsoft 365 Apps 
• Microsoft ASP.NET Core Runtime 10.0 
• Microsoft ASP.NET Core Runtime 8.0 
• Microsoft ASP.NET Core Runtime 9.0 
• Microsoft ASP.NET Core Runtime Hosting Bundle 10.0 
• Microsoft ASP.NET Core Runtime Hosting Bundle 8.0 
• Microsoft ASP.NET Core Runtime Hosting Bundle 9.0 
• Microsoft Edge Beta 
• Microsoft Edge for Business 
• Microsoft Remote Desktop 
• Microsoft Visio 
• Microsoft Visual Studio 2019 Enterprise 
• Microsoft Visual Studio 2019 Professional 
• Microsoft Visual Studio 2022 Enterprise 
• Microsoft Visual Studio 2022 Professional 
• Microsoft Windows Desktop Runtime 10.0 
• Microsoft Windows Desktop Runtime 8.0 
• Microsoft Windows Desktop Runtime 9.0 

Detailed list of June third-party patches 

Improve your patching and application delivery 

Modernize how you manage patches and applications across your environment with Right Click Tools Patching and Application Workspace.