Restart your browser this week: a Chrome flaw is being actively exploited

Week of 31 August to 6 September 2026

This week's most urgent item affects almost everyone: Chrome, Microsoft Edge and Opera share a flaw that criminals are already exploiting through malicious web pages, and the fix needs a browser restart to actually take effect. Check every computer in the business, not just install-and-forget. Sangoma Switchvox, phone-system software many small and medium offices run for their own calls and voicemail, also has a critical flaw that lets an attacker take it over without a password. Criminals are already exploiting that too, and Sangoma's fix has been available since July. PaperCut NG/MF, the network printing software flagged earlier this week, still needs that patch if you haven't applied it. SonicWall also confirmed active exploitation of two flaws in its SMA1000 remote-access appliances, a different product from SonicWall's common firewalls that mostly affects larger organisations. The Australian Cyber Security Centre also issued a critical alert for Citrix NetScaler, an edge device larger organisations and IT providers use for remote access. No evidence of exploitation yet, but the patch has been out since 19 August and there's no workaround. Only the browser fix applies to literally everyone; the other four only matter if you run that specific product.

1. 1

   Restart Chrome or Edge this week: a flaw is already being exploited4 Sept

   Effectively every business. Chrome and Microsoft Edge are the two most common browsers in Australian workplaces, and Opera shares the same underlying engine, so almost anyone browsing the web on a Windows, Mac or Linux computer is covered by this one. Firefox and Safari use a different engine and aren't affected by this specific flaw.

   Google fixed a flaw in V8, the engine at the core of Chrome and every other Chromium-based browser, including Microsoft Edge and Opera. It let a malicious web page take over part of the browser and run its own code, just from a visit to that page. Google says criminals are already exploiting it. The fix shipped in Chrome's regular update on 3 September 2026 (version 152.0.7977.82 or later); browsers install it automatically in the background, but it only takes effect once you restart.

   Do this

   Fully close and reopen Chrome, Edge or Opera on every computer in the business, or open the browser's "About" page (Settings → About Chrome / About Microsoft Edge), which checks for the latest version and restarts for you. No need to involve IT for this one; anyone can do it themselves in under a minute.

   Essential Eight: Patch applicationsISM: System patching

   Sources: CISA KEV: Google Chromium V8 flaw ↗ · Google Chrome stable channel update ↗CVE-2026-85046 · CWE-843

2. 2

   Run Sangoma Switchvox for your office phones? Update it now2 Sept

   Businesses that run their own on-premises Sangoma Switchvox SMB Edition phone system, rather than a cloud VoIP provider or a different PBX platform. If you don't know what phone system your business uses, ask your provider. This is exactly the kind of self-hosted office hardware that's easy to forget about once it's set up.

   Sangoma Switchvox is phone-system software many small and medium offices use to run their calls, extensions and voicemail over the internet instead of a traditional phone line. Security researchers found a flaw that lets an attacker take over its database (and potentially the whole server) using a single request, without needing a password. Criminals are already exploiting it against businesses that haven't updated. Sangoma fixed the flaw in version 8.4.0.2, released on 14 July 2026.

   Do this

   Ask whoever manages your phone system: "Are we running Sangoma Switchvox, and has it been updated to version 8.4.0.2 or later, which fixes CVE-2026-9586?"

   Essential Eight: Patch applicationsISM: System patching

   Sources: CISA KEV: Sangoma Switchvox flaw ↗ · Sangoma Switchvox 8.4.0.2 release notes ↗CVE-2026-9586 · CWE-89

3. 3

   Use PaperCut for network printing? It needs an emergency patch31 Aug

   Businesses, schools or print shops that run their own PaperCut NG or PaperCut MF server for network printing, common wherever staff share printers or multi-function devices. If your printing just runs through Windows or your printer manufacturer's own software, you're not running PaperCut and can skip this one.

   PaperCut NG and PaperCut MF (print management software many offices, schools and print shops use to track and control network printing) have two flaws that work together: one lets an attacker in without a password, the other then lets them run their own code on the print server. Criminals are already exploiting them, and US cyber security authorities have given a two-week deadline to patch. PaperCut published a fix on 27 August covering versions 24, 25 and 26 of both products.

   Do this

   Ask whoever manages your printers or IT: "Are we running PaperCut NG or MF, and has it been updated to the version that fixes CVE-2026-82078 and CVE-2026-81578 (24.1.10, 25.0.13, 26.0.5 or later)?"

   Essential Eight: Patch applicationsISM: System patching

   Sources: CISA KEV: PaperCut NG/MF flaws ↗ · PaperCut security bulletin ↗CVE-2026-82078 · CVE-2026-81578 · CWE-470 · CWE-306

4. 4

   Run a SonicWall SMA1000 for remote access? Patch it now (not the same as your SonicWall firewall)2 Sept

   Only businesses running a dedicated SonicWall SMA1000 appliance (models 6210, 7210 or 8200v) for remote-access VPN, typically larger organisations or an IT provider's managed remote-access setup. SonicWall confirms this does not affect SSL-VPN on ordinary SonicWall firewalls or the SMA 100 series, which is what most small businesses with SonicWall gear actually run. If that's you, skip this one.

   SonicWall SMA1000 is a separate product from SonicWall's common firewalls: an appliance some larger organisations and IT providers use to let staff connect in securely from outside the office. Two flaws let an attacker either bypass the login screen entirely or, with an existing admin account, run their own commands on the appliance. SonicWall confirmed it has already seen criminals exploiting these in the wild, and released a hotfix on 1 September 2026.

   Do this

   Ask your IT provider: "Do we run a SonicWall SMA1000 appliance for remote access, and has it been updated to the 1 September 2026 hotfix that fixes CVE-2026-83548 and CVE-2026-83549?"

   Essential Eight: Patch applicationsISM: System patching

   Sources: CISA KEV: SonicWall SMA1000 flaws ↗ · SonicWall security advisory ↗CVE-2026-83548 · CVE-2026-83549 · CWE-918 · CWE-441 · CWE-78

5. 5

   Use a Citrix NetScaler for remote access? Patch it now4 Sept

   Only organisations running an on-premises Citrix NetScaler ADC or NetScaler Gateway appliance for remote access, VPN or application delivery. This is typically infrastructure run by larger organisations or by an IT provider on behalf of several clients, not something most small businesses manage themselves. If you don't know whether you have one, your IT provider will.

   Citrix NetScaler ADC and NetScaler Gateway are network appliances that larger organisations and IT providers use as the front door for remote access, VPN connections and application delivery: hardware that sits directly on the internet. Citrix and the Australian Cyber Security Centre (ACSC) have flagged two critical flaws: one lets an attacker skip the login screen entirely on gateways set up for VPN or single sign-on, the other can crash the device in some network setups. There's no evidence yet that criminals are exploiting these, but ACSC issued its highest alert level because these devices are a common target once flaws like this go public, and there's no workaround: only the patch, which Citrix released on 19 August 2026.

   Do this

   Ask your IT provider: "Do we run a Citrix NetScaler ADC or Gateway, and has it been updated to fix CVE-2026-19489 and CVE-2026-19490 (version 14.1-73.32, 13.1-63.21 or later)?"

   Essential Eight: Patch applicationsISM: System patching

   Sources: ACSC alert: Critical vulnerabilities in Citrix NetScaler ADC and Gateway ↗ · Citrix security bulletin CTX696939 ↗CVE-2026-19489 · CVE-2026-19490 · CWE-119 · CWE-288

Latest ISM release: ISM September 2026: What Changed and What to Check →What the ISM is and how we assess it →