Another Chrome Zero-Day Another Supply Chain

Google released Chrome updates fixing 21 vulnerabilities including CVE-2026-5281, a zero-day in the WebGPU Dawn component already exploited in the wild and added to the KEV catalog — the third Chrome zero-day cycle in three weeks. Google attributed the Axios npm supply chain compromise to a state-linked threat cluster, confirming that the developer supply chain is now a battleground for both criminal and state-linked operations. Citrix NetScaler CVE-2026-3055 has been added to the KEV catalog after confirmed exploitation. Fortinet FortiClient EMS CVE-2026-21643 is under active exploitation via SQL injection — another management plane target. A critical zero-click Telegram RCE was disclosed.