Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 * Google has issued an urgent security update for Chrome to mitigate CVE-2026-2441, a critical type confusion vulnerability in the V8 JavaScript engine that is currently under active exploitation in the wild. * The flaw affects Chrome desktop versions prior to 122.0.
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 Fake AI Chrome extensions with 300K users steal credentials, emails * 30 malicious Chrome extensions, posing as AI assistants, tricked over 300,000 users. * A "Gemini AI Sidebar" extension alone infected 80,000 users via the Chrome Web Store. * Extensions
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 Brave launches most powerful search API for AI to date * Brave launched a new Search API featuring Zero Data Retention (ZDR) and SOC 2 Type II compliance. * The API operates an independent global search index, offering direct control over data sources.
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 zkLogin: when ZKP is not enough * Critical vulnerabilities discovered in zkLogin blockchain authorization, despite using zero-knowledge proofs. * Identified flaws include JWT parsing ambiguities, weak token binding, centralization risks, and impersonation attacks. * Zero-knowledge proofs alone do not guarantee secure authentication, due to
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 Adblock Filters Exposes Reveal User Location Despite VPN Protection * New fingerprinting bypasses VPNs, exposing user location via AdBlock filter lists. * Malicious websites exploit country-specific AdBlock filter lists to pinpoint user location. * Browser configurations leveraged by malicious sites bypass VPNs by probing
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 EDR, Email, and SASE Miss This Entire Class of Browser Attacks * EDR, email security, and SASE tools fail to detect sophisticated browser-level attacks. * Attack vectors include ClickFix social engineering, malicious extensions, Man-in-the-Browser, and HTML smuggling. * Organizations need critical browser-level security observability
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 Critical 0-Click RCE Vulnerability in Claude Desktop Extensions Exposes 10,000+ Users to Remote Attacks * Zero-click RCE vulnerability discovered in Claude Desktop Extensions (DXT) allows arbitrary code execution. * Over 10,000 users affected; exploit occurs via a maliciously crafted Google Calendar
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 The Brave Search API's integration into Snowflake enables agentic web search for enterprise customers * Brave Search API integrates with Snowflake, offering privacy-focused web search for enterprises. * API provides real-time web data from an independent index, with SOC 2 Type
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 * German intelligence agencies BSI and BfV issued a joint warning regarding an active phishing campaign targeting high-profile individuals, including politicians, military personnel, and journalists, via the Signal messaging app. * This campaign leverages sophisticated social engineering to deceive victims into clicking malicious
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 * Mozilla's PDF.js, a popular open-source JavaScript library widely used for in-browser PDF rendering, has addressed critical code injection and crash vulnerabilities. * The code injection flaw could enable attackers to execute arbitrary JavaScript code within a user's
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 Blesta Reflected XSS Flaw Endangers Client Management Portals * A reflected Cross-Site Scripting (XSS) vulnerability, tracked as KIS-2026-01, has been identified in Blesta versions up to 5.13.1, specifically affecting the confirm_url parameter. * This flaw enables attackers to inject arbitrary
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 Foxit Releases Security Updates for PDF Editor Cloud XSS Vulnerabilities * Foxit released security updates for its PDF Editor Cloud, addressing multiple Cross-Site Scripting (XSS) vulnerabilities. * These XSS flaws could allow attackers to inject malicious scripts into web pages viewed by users,