[chrome]

October 27, 2026

• Windows primitives doing the rounds: CVE-2026-40369 is described as an unprivileged arbitrary 12-byte kernel write in nt!ExpGetProcessInformation, reachable from any context that can call NtQuerySystemInformation — including sandboxed Chrome, Edge and Firefox renderers — with PoC and write-up published (@DarkWebInformer). Separately, CVE-2025-24071: extracting a .rar containing a malicious .library-ms file makes Explorer initiate outbound SMB authentication, leaking the NTLM hash with no further interaction ([@DarkWebIn · Vulnerabilities & Exploits

in Brotli's Blast Radius Widens as PHP2Shell Lands on KEV

October 21, 2026

• Eight eMudhra intermediate CA private keys were weak enough to recover almost immediately. Six intermediates were for TLS and two for code signing, giving key holders the ability to issue credentials trusted by major platforms. Mozilla, Chrome, Apple, Go and others have blocked them, but stale Linux systems, containers, embedded devices and bundled trust stores will create a long cleanup tail. No malicious TLS issuance has been found in certificate-transparency logs, according to Ars Technica; Mozilla details its response. (discussion) · Vulnerabilities & Exploits

in PHP’s php2shell RCEs Break Cover

September 24, 2026

• UTA0565 ran the Chrome-to-Windows chain as zero-days on 3–4 September. Volexity attributes attacks combining CVE-2026-85046 and CVE-2026-87491 in Chrome with Windows ALPC flaw CVE-2026-85880 — the BlueMoon exploit kit — delivered from fake sites imitating China Digital Times and the Center for American Progress in emails to Asian government entities. The payload, CLEANGULP, supports shell, process listing, file upload/download and beacon object file execution, and beacons to a domain typosquatting theconversation.com. Volexity assesses the kit is shared across multiple Chinese operators (The Hacker News). · Threat Activity
• Google pulled a cluster of Chrome extensions that enrolled browsers into the Mellowtel scraping botnet, with Spur measuring the proxy node count falling from around 90,000 (Catalin Cimpanu). · Threat Activity

in The Exploit Is Public, the Ubuntu Patch Isn't

September 17, 2026

• BragJack hijacked the built-in assistants in five Chromium products — Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon and the Claude in Chrome extension — from one ordinary browser extension, exploiting a shared design flaw rather than the models' guardrails. Reported capabilities vary by target: local file access, microphone/camera and screenshots on Chrome and Comet, browser-agent hijack on Comet, Edge, Opera Neon and Claude, with no further user clicks once the extension was in place. Two CVEs came out of it (CVE-2026-0628, CVE-2026-55945) and bounties ran $600–$7,000 per vendor. Forever Security, The Hacker News. Commenter matanix3 raises the obvious follow-on question — whether malicious websites can drive the same agents (discussion). · AI & Agent Security
• Nextron flagged a coordinated npm campaign hiding malicious behaviour in packages posing as runtime, process, layout and image utilities. On import they spawn a hidden Node.js process that fetches and executes code from api.npoint[.]io JSON storage; the payload collects system and network details, steals Chrome extension data, monitors the clipboard and can enable a Windows keylogger. IOCs in the thread. @nextronresearch. · Supply Chain
• KREMLIN force-installs Chrome and Edge extensions without user approval — it waits for or kills the browser, copies the extension into the profile directories, enables developer mode, then retrieves the browser's own encryption keys to regenerate the Secure Preferences HMACs so the add-on passes Chromium's integrity checks. The chain starts from a JS file masquerading as an invoice, pulls Node.js, persists via scheduled task, and resolves its payload location from an Ethereum smart contract. Elastic tracks the Brazilian operation as REF9334 across at least seven campaigns since May 2025 impersonating 12 banks, with 1,515 confirmed infections almost all in Brazil. BleepingComputer, The Hacker News. · Threat Activity

in One Extension Hijacks the AI Assistant in Five Major Browsers

September 15, 2026

• “Twitch Enhanced Viewer | JeetBot” exposed live Twitch OAuth tokens to operator-controlled proxies. Socket found that version 85.x placed tokens in an auth query parameter for every watched channel except ten hardcoded Russian-language channels, making them available in proxy logs. Store listings showed roughly 31,000 users across Chrome and Firefox; tokens could reach chat, whispers, and account settings. Both add-ons were still listed on September 14, The Hacker News reports. · Cloud, Identity & Supply Chain

in Scope Questions Recast Anthropic’s “Rogue Agent” Incidents

September 10, 2026

• BlueMoon, a previously undocumented exploit kit, chains a V8 type-confusion bug (CVE-2026-85046), a V8 sandbox escape, and a Windows kernel LPE (CVE-2026-85880) present only in older Windows builds. Both V8 bugs were "patch-gap" zero-days: the fix for CVE-2026-85046 was committed upstream on 7 August but did not reach stable Chromium until 3 September. First use was TA412 (APT31 / Violet Typhoon) on 28 August against US NGOs, mining companies and commodity trading firms; UNK_LateNight hit US aerospace from 2 September, UNK_DoubleCheck a Vietnamese manufacturer via a compromised Southeast Asian government mailbox, and UNK_QuietRacket government, consulting and financial targets in Indonesia and Singapore from 3 September. Identical orchestration and loading across samples points to one builder; how multiple actors obtained it is unknown (Proofpoint, The Record). · Exploited in the Wild
• Chrome shipped 230 fixes on Tuesday including CVE-2026-87491, an out-of-bounds write in V8 under active exploitation — the seventh exploited Chrome zero-day this year, and distinct from the BlueMoon CVEs (BleepingComputer, The Hacker News). · Exploited in the Wild
• Fortinet patched an unauthenticated authentication bypass in FortiMonitorOnSight plus a flaw in the Privileged Access Agent browser extension where any visited site could reconfigure the agent's proxy and observe the user's tab (SecurityWeek, research write-up). · Exploited in the Wild

in One Exploit Kit, Four Espionage Crews: BlueMoon Turns Chrome's Patch Gap Into a Shared Weapon

September 8, 2026

• PEEP is a Chromium-based post-exploitation toolkit posing as a "Smart Bookmarks" extension. Given prior admin or code execution, its installer injects the extension straight into Chrome/Edge profiles and forges Chromium's own Secure Preferences integrity values to bypass Web Store checks and user prompts; a native-messaging component takes it beyond browser telemetry into host command execution and file management (SOCRadar, The Hacker News). · Threat Activity

in N-able Ships a Fourth N-central Hotfix in Five Weeks — and Can't Agree Whether It's Exploited

August 29, 2026

• 18 Chrome and one Edge extension published over the past six months shipped wallet-secret theft and crypto-draining code, sharing enough code and tradecraft to indicate a single cluster, per Socket (The Hacker News). · Threat Activity

in PaperCut Ships a Second Emergency Patch After Researchers Bypass the First

August 22, 2026

• Kimsuky is installing a malicious Chrome extension that auto-exfiltrates victims' Gmail to C2 in spear-phishing against South Korean and Japanese targets, alongside abuse of legitimate remote-control tooling. Korean-language comments and debug strings throughout the extension's JavaScript suggest most of it was written with generative AI (ENKI). · Threat Activity

in A CVSS 10.0 Lands in Entra ID — and Microsoft Can't Keep Its Exploitation Story Straight

July 24, 2026

• msaRAT, a new Rust backdoor from the Chaos ransomware crew, tunnels C2 through headless Chrome/Edge and WebRTC. Cisco Talos found it abusing the Chrome DevTools Protocol and WebRTC DataChannels, ChaCha20-Poly1305-encrypting payloads, and hiding behind Twilio TURN and Cloudflare Workers to blend into legitimate traffic. Talos, BleepingComputer. · Threat Activity

in The Week AI Agents Started Doing the Hacking