ALL POSTS

Key Findings Google has rolled out Device Bound Session Credentials (DBSC) in Chrome 146 for Windows to prevent hackers from using stolen session cookies to access user accounts The system binds login sessions to a device's hardware security chip, making exfiltrated cookies unusable on other machines Early testing shows a measurable drop in successful infostealer attacks through Origin Trials with partners like Okta Over 30 million computers were infected with infostealer mal

Key Findings Google patched CVE-2026-5281, a use-after-free vulnerability in the WebGPU Dawn component that is actively being exploited This marks the fourth Chrome zero-day under active exploitation in 2026 Users are urged to update immediately to Chrome 146.0.7680.177/178 (Windows/macOS) or 146.0.7680.177 (Linux) The vulnerability affects graphics processing capabilities and could allow attackers to execute malicious code or crash the browser Google withheld technical explo

Key Findings 287 different Chrome browser extensions are actively stealing the web histories of roughly 37.4 million people These extensions, often disguised as "harmless tools" like ad blockers or search assistants, are feeding user data to a network of global corporations and data brokers The research team identified many of these tools sending user data in plain text and using "obfuscation" techniques to hide their tracks, scrambling history into codes before sending it of

Key Findings: Two malicious Google Chrome extensions named "Phantom Shuttle" have been discovered secretly stealing user credentials from over 170 websites. The extensions are advertised as a "multi-location network speed test plug-in" for developers and foreign trade personnel. The extensions execute complete traffic interception, operate as man-in-the-middle proxies, and continuously exfiltrate user data to a command-and-control server. Once users make a subscription paymen

Key Findings Google addressed three vulnerabilities in the Chrome browser, including a high-severity bug already exploited in the wild. Google tracked the high-severity vulnerability as Chromium issue 466192044, but did not share technical details. The bug lies in the ANGLE graphics library, where buffer sizes were incorrectly calculated, leading to memory corruption, crashes, or potentially arbitrary code execution. Google also fixed two medium-severity flaws: a use-after-fr

Key Findings Google released security updates for Chrome to address two security flaws, including one that is being actively exploited in the wild. The actively exploited vulnerability is CVE-2025-13223, a type confusion vulnerability in the V8 JavaScript and WebAssembly engine that could lead to arbitrary code execution or program crashes. Clément Lecigne of Google's Threat Analysis Group (TAG) discovered and reported the flaw on November 12, 2025. Google has not provided de

Key Findings Google has released an emergency security update for Chrome Stable Channel, addressing a high-severity vulnerability in the V8 JavaScript engine (CVE-2025-13042) The vulnerability, described as an "inappropriate implementation in V8", could potentially lead to type confusion, memory corruption, or arbitrary code execution While no active exploitation is reported, V8 flaws have historically been targeted by threat actors for zero-day exploits in spear-phishing and