Google Security Updates — July 2026
Roundup of Google security advisories published in July 2026.
CVE search metadata
CVE search record: CVE-2026-15899. Severity: critical. CVSS: 9.6. EPSS: 0.24%. KEV: no. Brief: Google Security Updates — July 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-07-google-security-updates/
CVE search record: CVE-2026-15901. Severity: critical. CVSS: 9.6. EPSS: 0.26%. KEV: no. Brief: Google Security Updates — July 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-07-google-security-updates/
CVE search record: CVE-2026-16423. Severity: high. CVSS: 8.8. EPSS: 0.20%. KEV: no. Brief: Google Security Updates — July 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-07-google-security-updates/
CVE search record: CVE-2026-15904. Severity: high. CVSS: 8.8. EPSS: 0.24%. KEV: no. Brief: Google Security Updates — July 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-07-google-security-updates/
CVE search record: CVE-2026-15902. Severity: high. CVSS: 8.8. EPSS: 0.28%. KEV: no. Brief: Google Security Updates — July 2026. Brief link: https://feed.craftedsignal.io/briefs/2026-07-google-security-updates/
What's new
Aggregated Google security advisories for July 2026. CVEs from this cycle are folded into the list below as they are published.
Recommendation
Review affected products and apply Google's July 2026 security updates.
Indicators of compromise
7
domain
4
file_name
3
file_path
1
filename
2
ip
4
other
2
product_name
18
url
| Type | Value |
|---|---|
| url | https://www.recordedfuture.com/research/from-castleloader-to-castlerat-tag-150-advances-operations |
| url | https://peter.sh/experiments/chromium-command-line-switches/ |
| url | https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/browser_unusual_flag/castle_chrome_shell32.log |
| file_name | Local State |
| file_name | Login Data |
| file_path | *\temp\* |
| url | https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer |
| file_path | *\AppData\Local\Google\Chrome\User Data\Default\Login Data |
| url | https://x.com/suyog41/status/1825869470323056748 |
| url | https://g0njxa.medium.com/from-vietnam-to-united-states-malware-fraud-and-dropshipping-98b7a7b2c36d |
| domain | apps.googleusercontent.com |
| url | https://support.google.com/a/answer/175197 |
| url | https://support.google.com/a/answer/7587183 |
| url | https://support.google.com/a/answer/7061566 |
| url | https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-google_workspace.html |
| url | https://www.elastic.co/security-labs/google-workspace-attack-surface-part-one |
| url | https://www.elastic.co/security-labs/google-workspace-attack-surface-part-two |
| url | https://sploitus.com/exploit?id=D0DC4908-C0DC-539F-BC8B-A87CCD40BBFF |
| filename | invoices.apk |
| url | https://cloudrun01-abc.europe-west3.run.app/ |
| other | kubernetes.io/kube-apiserver-client |
| other | system:kube-controller-manager |
| other | system:masters |
| other | system:admin |
| ip | 169.254.169.254 |
| domain | metadata.google.internal |
| domain | enavalenceart[.]com |
| domain | syncmcchub[.]blogspot[.]com |
| domain | mcc-sync-ads[.]com |
| url | https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0256605430.html |
| url | http://172.86.126.18:443/update_ms.msi |
| ip | 172.86.126.18 |
| file_name | update_ms.msi |
| file_path | C:\programdata\update_ms.msi |
| file_name | lib.dll |
| product_name | msaRAT |
| product_name | Chaos ransomware |
| domain | cloudflare.com |
| domain | twilio.com |
| url | https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_01320465736.html |
| url | https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html |