CERT-In has issued fresh warnings covering Microsoft products and desktop Google Chrome, giving Indian users separate update checks. Its 14 October notices rate the warnings high and critical, respectively. The Windows warning identifies a flaw already being exploited, while the Chrome notice makes no such claim.
The Microsoft notice, CIAD-2026-0047, singles out CVE-2026-96951 in Windows Shell and urges immediate patching. It describes a crafted-file attack requiring the user to interact with the file. Neither advisory reports an Indian breach or gives a victim count.
Windows: an exploited flaw and branch-specific fixes
The US Cybersecurity and Infrastructure Security Agency added the same Windows flaw to its official Known Exploited Vulnerabilities catalogue on 13 October. Its entry gives 16 October as the remediation due date. That date belongs to US federal remediation obligations; it is not an Indian consumer deadline. CISA's explanation of the governing directive limits its mandatory scope to Federal Civilian Executive Branch agencies.
The catalogue records known ransomware-campaign use as unknown. That is a narrower statement than saying ransomware attacks have been confirmed, and it should not be read as assurance that the flaw is harmless. For readers outside the US federal system, the relevant warning is the evidence of exploitation and the available vendor fix, rather than a foreign compliance date. The entry also flags forensic triage as required: for the covered agencies, installing a patch and checking for an earlier compromise are separate tasks.
For Windows 11 versions 24H2, 25H2 and 26H2, Microsoft lists KB5127648, released on 13 October. The corresponding builds are 26100.9711, 26200.9711 and 26300.9711. The same release note says October is the last monthly security update for Windows 11 24H2 Home and Pro. Users of those editions need to plan an upgrade to a supported release.
Microsoft also lists known issues affecting some Remote Desktop connections and USB Audio Class 1.0 equipment. The Remote Desktop problem concerns non-administrator access to remote devices with Administrator protection enabled. The USB issue began with September updates and is partly resolved. Missing sound or a connection failure therefore needs its own diagnosis. On a managed office computer, report the symptoms to the administrator rather than making an improvised change to security settings.
Microsoft's installation guidance directs Windows 11 users to Settings, Windows Update, then Check for Windows updates. Install available updates and restart if prompted. Older PCs have separate support considerations, covered in Dalimss News' Windows 10 ESU report.
Chrome: check the full browser version
The second Indian notice, CIVN-2026-0505, concerns desktop Chrome on Windows, macOS and Linux. It warns that the listed vulnerabilities could enable code execution, information disclosure, privilege escalation, security bypass or denial of service. Its affected-version thresholds must be checked against the browser, separately from Windows.
Google's 13 October stable-channel announcement identifies Chrome 155.0.8059.79/.80 for Windows and Mac, and 155.0.8059.79 for Linux. It lists 37 security fixes. Seven entries carry a critical rating, including flaws in ANGLE, PDF handling and other browser components. These are vulnerability records, not a tally of attacks or affected Indian users. Google is withholding some bug details until more users have installed the fixes.
Google says the desktop rollout will take place over the coming days and weeks. To check an installed desktop browser, open its menu, choose Help and About Google Chrome, and use Relaunch when offered. The official update instructions say the update takes effect after Chrome restarts. Linux users should use their package manager. Chrome normally restores ordinary tabs after restarting, but Google warns that Incognito windows do not reopen.
Google also released Chrome 155.0.8059.79 for Android and says it carries the corresponding desktop security fixes unless otherwise noted. That separate app rollout does not turn the Indian desktop advisory into an Android operating-system patch notice.
Dalimss News' earlier Chrome warning covered the 6 October advisory and a different set of vulnerabilities. Readers who acted on that report still need to check the newer release. The browser and operating system have separate version numbers, so confirming one update does not confirm that both checks are complete.
