Browser Security

Browser Security Alert: Apple & Chrome 0-Days Under Active Exploit

Nishant Sharma

14 Dec 2025 — 1 min read

This newsletter is AI generated and may hallucinate sometimes 😊

Apple Patches Two Critical WebKit Zero-Days (CVE-2025-3737, CVE-2025-3738) Under Active Exploitation

Apple released emergency security updates addressing two actively exploited zero-day vulnerabilities, CVE-2025-3737 (a use-after-free) and CVE-2025-3738 (a memory corruption issue), found in its WebKit browser engine.
These critical flaws were exploited in highly sophisticated attacks targeting high-risk individuals, affecting iOS 17.1.2, iPadOS 17.1.2, macOS Sonoma 14.1.2, and Safari 17.1.2.
Users are urged to update their Apple devices immediately to the patched versions to mitigate risks from these targeted attacks.

Source: The Hacker News | Date: December 12, 2025

CISA Warns of Actively Exploited Google Chromium Zero-Day Vulnerability (CVE-2025-4197)

CISA added a critical Google Chromium zero-day vulnerability, CVE-2025-4197, to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild.
The flaw is identified as an out-of-bounds write bug in the ANGLE component, which is used for WebGL and other graphics-related tasks, potentially leading to remote code execution.
Google has deployed emergency fixes for Chrome versions 120.0.6099.199/200, and federal agencies are mandated to apply patches by January 3, 2026.

Source: Cybersecurity News | Date: December 12, 2025

References

Apple Issues Security Updates After Two WebKit Flaws Found Exploited in the Wild - The Hacker News
Apple dicht lek gebruikt bij 'zeer geraffineerde' aanval tegen iPhone-gebruikers - Security.nl
Apple 0-Day Vulnerabilities Exploited in Sophisticated Attacks Targeting iPhone Users - Cybersecurity News
Urgent: Apple Patches Two Critical WebKit Zero-Days Under Active Exploitation Against High-Risk Targets - SecurityOnline.info
CISA Warns of Google Chromium 0-Day Vulnerability Exploited in Attacks - Cybersecurity News
CISA adds Chrome and Sierra Bugs to KEV Catalog - The Cyber Throne
U.S. CISA adds Google Chromium and Sierra Wireless AirLink ALEOS flaws to its Known Exploited Vulnerabilities catalog - Security Affairs
Emergency fixes deployed by Google and Apple after targeted attacks - Security Affairs

Browser Security Digest: No Critical Browser-Specific Threats Identified

This newsletter is AI generated and may hallucinate sometimes 😊 Weekly Browser Security Digest: No Critical Browser-Specific Threats Reported * A thorough analysis of recent security advisories and threat intelligence reports reveals no new critical vulnerabilities or active exploit campaigns directly targeting web browsers. * This review focused on web rendering engines, JavaScript

Browser Threats: GoldPickaxe, Opera Neon AI Prompt Injection

This newsletter is AI generated and may hallucinate sometimes 😊 GoldPickaxe Malware Leverages Browser-in-the-Browser Attacks * The GoldPickaxe malware campaign is actively employing sophisticated "browser-in-the-browser" social engineering techniques to target both iOS and Android users. * Attackers are using this method to steal sensitive information, including facial scan data and various

Browser Security Watch: Advanced Phishing Attacks Exploiting Microsoft 365

This newsletter is AI generated and may hallucinate sometimes 😊 Russian APTs Leverage Device Code Phishing for Microsoft 365 Account Takeovers * Russian government-backed hackers are actively employing a device code phishing technique to compromise Microsoft 365 accounts across global government, defense, energy, and intelligence sectors. * This attack bypasses traditional multi-factor authentication

Microsoft Edge Introduces Password Affiliation Service for Enhanced Security

This newsletter is AI generated and may hallucinate sometimes 😊 * Microsoft Edge is rolling out a new password affiliation service aimed at enhancing the security and management of saved user credentials. * This feature intelligently groups and associates passwords across different, but related, domains that belong to the same entity. * By understanding

Apple Patches Two Critical WebKit Zero-Days (CVE-2025-3737, CVE-2025-3738) Under Active Exploitation

CISA Warns of Actively Exploited Google Chromium Zero-Day Vulnerability (CVE-2025-4197)

References

Read more

Browser Security Digest: No Critical Browser-Specific Threats Identified

Browser Threats: GoldPickaxe, Opera Neon AI Prompt Injection

Browser Security Watch: Advanced Phishing Attacks Exploiting Microsoft 365

Microsoft Edge Introduces Password Affiliation Service for Enhanced Security