Browser Security Updates: Skimming, Chrome Extension, SmartScreen

Long-Running Web Skimming Campaign Targets Online Checkout Pages

• A persistent web skimming campaign, active for over two years, has been identified, targeting online e-commerce checkout pages to steal payment card information.
• Attackers inject malicious JavaScript code into legitimate websites, which intercepts data entered into payment forms before it reaches the vendor's server.
• The campaign leverages obfuscation techniques and constantly changes infrastructure to evade detection, posing a significant threat to online retailers and consumers.

Source: The Hacker News | Date: January 17, 2026

Malicious Chrome Extension Impersonates Trading Tool to Steal MEXC API Keys

• A malicious Google Chrome extension, disguised as a legitimate MEXC Global trading utility, was discovered stealing users' API keys and other sensitive information.
• The extension targeted cryptocurrency traders, leveraging its apparent legitimacy to gain trust and access high-value credentials that could lead to unauthorized crypto transactions.
• Users are urged to exercise extreme caution when installing browser extensions, verifying developer legitimacy and permissions requested, and removing suspicious extensions immediately.

Source: The Hacker News | Date: January 17, 2026

Microsoft January 2026 Patch Tuesday Addresses Windows SmartScreen Security Bypass

• Microsoft's January 2026 Patch Tuesday addressed 114 vulnerabilities, including a Windows SmartScreen Security Feature Bypass (CVE-2026-20050) that was actively exploited as a zero-day.
• CVE-2026-20050 allowed attackers to circumvent security measures intended to warn users about malicious files, potentially leading to the execution of untrusted code or content.
• Users and administrators are strongly advised to apply the latest security updates immediately to protect against this and other critical vulnerabilities fixed in this release.

Source: BleepingComputer | Date: January 14, 2026

High-Severity SVG Flaw in Angular (CVE-2026-22610) Exposes Applications to XSS

• A high-severity SVG flaw, tracked as CVE-2026-22610, has been identified in the Angular framework, enabling cross-site scripting (XSS) attacks in applications.
• The vulnerability allows attackers to inject malicious SVG content that, when rendered by a browser, can execute arbitrary JavaScript in the context of the user's session, leading to data theft or session hijacking.
• Developers using Angular are urged to update their applications to the patched versions to mitigate the risk of XSS attacks leveraging this vulnerability.

Source: SecurityOnline.info | Date: January 14, 2026

References

1. Long-Running Web Skimming Campaign Steals Credit Cards From Online Checkout Pages - The Hacker News
2. Malicious Chrome Extension Steals MEXC API Keys by Masquerading as Trading Tool - The Hacker News
3. Microsoft January 2026 Patch Tuesday fixes 3 zero-days, 114 flaws - BleepingComputer
4. The January 2026 Security Update Review - The Zero-Day Initiative (ZDI)
5. Microsoft Patch Tuesday January 2026 – 114 Vulnerabilities Fixed Including 3 Zero-days - Cybersecurity News
6. Angular Security Alert: High-Severity SVG Flaw CVE-2026-22610 Exposes Apps to XSS - SecurityOnline.info
7. New Angular Vulnerability Enables an Attacker to Execute Malicious Payload - Cybersecurity News