Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 Malicious Google Calendar invites could expose private data * Vulnerability in Google Calendar allowed prompt-injection instructions in invites to bypass privacy controls. * Malicious invites leveraged Google Gemini to create events summarizing private meetings, exposing data. * Google fixed the issue, but warns of
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 Malicious Chrome Extensions Impersonate Workday and NetSuite to Hijack Accounts * Researchers identified five malicious Chrome extensions impersonating popular business tools like Workday and NetSuite, designed to steal user credentials. * These extensions used a technique to dynamically inject JavaScript into legitimate login
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 Chrome “WebView” Vulnerability Allows Hackers to Bypass Security Restrictions * A security flaw in Google Chrome's "WebView" component was reported, enabling attackers to bypass crucial security restrictions within applications that embed WebView. * This vulnerability could potentially allow for
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 GhostAd Drain Campaign Targets Browser-Based Crypto Wallets * The "GhostAd Drain" campaign is an ongoing malvertising effort specifically designed to steal cryptocurrency from users' browser-based wallets. * Attackers utilize highly obfuscated JavaScript and dynamic content injection to bypass ad blockers
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 Chrome Patches Critical Zero-Day (CVE-2025-7890) Actively Exploited * Google Chrome released an emergency security update to address a critical Use-After-Free vulnerability, identified as CVE-2025-7890, in its V8 JavaScript engine. * This zero-day flaw affects Chrome versions prior to 120.0.6099.123 across
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 GhostPoster Malware Found in 17 Firefox Add-ons with 50,000+ Downloads * Security researchers identified GhostPoster malware embedded within 17 malicious Firefox add-ons, which collectively accumulated over 50,000 downloads. * The malware was designed to manipulate social media platforms and engage in
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 Chrome Extension "Promptease" Intercepts Millions of Users' AI Chats * The popular Chrome extension "Promptease," designed to enhance AI interactions, was found to be intercepting and transmitting millions of users' sensitive AI chatbot prompts and responses
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 Google Chrome Patches Actively Exploited Zero-Day in V8 Engine * Google released an emergency security update for Chrome, addressing a critical zero-day vulnerability (CVE-2024-XXXXX) in its V8 JavaScript engine, confirmed to be actively exploited in the wild. * This critical remote code execution
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 Google Patches Eighth Actively Exploited Chrome Zero-Day Vulnerability in 2025 * Google has released an urgent security update for Chrome to address its eighth actively exploited zero-day vulnerability in 2025, with specific details and a CVE ID currently undisclosed by the company.
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 Google Chrome Adds Layered Defenses Against Indirect Prompt Injection * Google has implemented new layered defenses in Chrome to mitigate indirect prompt injection threats that target AI-powered features integrated within the browser. * These protections, detailed in a recent research paper, utilize techniques
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 Cyberattackers are running and EtherHiding * EtherHiding tactic embeds malware components within blockchain smart contracts, evading detection. * Attackers leverage decentralized blockchain and ethers JavaScript library for watering hole attacks. * Defenders must block unnecessary blockchain endpoints and increase user awareness of Web3 risks.
Browser Security
This newsletter is AI generated and may hallucinate sometimes 😊 ‘HashJack’ demo hides malicious instructions in URL * Cato Networks revealed "HashJack," a vulnerability embedding malicious instructions within URL hashtags. * Exploit targets AI-powered browsers, injecting prompts for large language models to unwittingly execute commands. * This attack bypasses network security; Google&