Browser Security

Urgent Browser Security Alert: Chrome, Firefox, Edge, and Safari Face Zero-Day Threats and Critical Patches

Nishant Sharma

— 9 min read

Introduction

In an increasingly interconnected digital landscape, web browsers have become the primary gateway to online activity, making them a prime target for cyber attackers. Recent weeks have brought a flurry of critical security updates and emerging threats across major browsers including Google Chrome, Mozilla Firefox, Microsoft Edge, and Apple Safari. This post will detail the most significant browser-related security incidents, including actively exploited zero-day vulnerabilities, important patches, and new security enhancements. Understanding these developments is crucial for maintaining robust cybersecurity posture for both individual users and enterprise environments.

The urgency to patch and update is paramount, as multiple zero-day vulnerabilities exploited in the wild highlight the sophisticated and persistent nature of current cyber threats. From critical remote code execution flaws to widespread malicious extension campaigns, the focus on browser security has never been more intense. This analysis aims to provide actionable intelligence to help you stay ahead of the curve.

Google Chrome

CVE-2025-10585 & CVE-2025-5419: Actively Exploited V8 Zero-Days

  • CVE IDs: CVE-2025-10585, CVE-2025-5419
  • Severity: Critical (Actively Exploited)
  • Affected Versions/Platforms: Google Chrome (specific versions patched in emergency updates). CVE-2025-10585 is reportedly the sixth actively exploited zero-day for Chrome in 2025.
  • Exploit Status: Actively exploited in the wild (zero-day).
  • Patch/Workaround: Google has released emergency patches. Users are urged to update their Chrome browser immediately to the latest stable version.
  • Details: CVE-2025-10585 and CVE-2025-5419 are type confusion vulnerabilities within Chrome's V8 JavaScript engine. Such flaws can enable remote code execution simply by visiting a crafted HTML page, posing a severe risk to user data and system integrity. The frequent discovery and exploitation of V8 zero-days highlight the ongoing challenges in securing complex browser components.

CVE-2025-6554: Chromium RCE Zero-Day

  • CVE ID: CVE-2025-6554
  • Severity: Critical (Actively Exploited), potential for Remote Code Execution (RCE).
  • Affected Versions/Platforms: Chromium-based browsers, including Google Chrome and Microsoft Edge.
  • Exploit Status: Actively exploited in the wild (zero-day).
  • Patch/Workaround: Users should update Chrome and Edge to their latest stable versions to receive the patch.
  • Details: This zero-day vulnerability impacts the underlying Chromium engine, making it a threat to all browsers built on Chromium. Successful exploitation could lead to remote code execution, giving attackers full control over affected systems.

SameSite Cookie Bypass on Android

  • CVE ID: Not specified in the available information.
  • Severity: High (Implied, as it impacts fundamental web security mechanisms).
  • Affected Versions/Platforms: Google Chrome on Android devices.
  • Exploit Status: A bug allowed SameSite cookie bypass.
  • Patch/Workaround: Addressed in recent Chrome updates. Users should ensure their Android Chrome browser is up to date.
  • Details: A flaw in Chromium allowed a SameSite cookie bypass on Android, which could potentially undermine protections against Cross-Site Request Forgery (CSRF) and impact session management, making users vulnerable to various web-based attacks.

Malicious Extensions Campaign

  • CVE ID: Not applicable (campaign, not a single vulnerability).
  • Severity: High (Over 2 million downloads, potential for widespread data theft and system compromise).
  • Affected Versions/Platforms: Google Chrome and Microsoft Edge.
  • Exploit Status: Active malicious campaign, millions of downloads.
  • Patch/Workaround: Users should regularly review installed extensions, remove suspicious ones, and rely on official app stores. Browser vendors are actively working to detect and remove these extensions.
  • Details: A widespread campaign involving malicious browser extensions has affected millions of Chrome and Edge users. These extensions often masquerade as legitimate tools but steal data, inject ads, or redirect traffic, highlighting the critical need for vigilance when installing browser add-ons.

Mozilla Firefox

Two Zero-Day Vulnerabilities Patched (May 2025)

  • CVE IDs: Not explicitly named in the provided sources, referred to as "two Firefox zero-day vulnerabilities."
  • Severity: Critical (Actively Exploited)
  • Affected Versions/Platforms: Mozilla Firefox (emergency updates in May 2025).
  • Exploit Status: Actively exploited in the wild (zero-days).
  • Patch/Workaround: Immediate patching was strongly recommended. Users should ensure their Firefox browser is updated to the latest available version.
  • Details: In May 2025, Mozilla released emergency updates to address two critical zero-day vulnerabilities actively exploited. These types of vulnerabilities often allow attackers to execute arbitrary code or bypass security measures, making rapid patching essential for user safety.

macOS XCSSET Variant Targeting Firefox

  • CVE ID: Not applicable (malware campaign).
  • Severity: High (Data theft, persistence).
  • Affected Versions/Platforms: Firefox on macOS.
  • Exploit Status: Active malware campaign.
  • Patch/Workaround: Keep macOS and Firefox updated. Use robust endpoint protection. Be cautious about opening suspicious files or clicking on unknown links.
  • Details: A new variant of the XCSSET malware is specifically targeting Firefox users on macOS. This variant includes "clipper" functionality to steal cryptocurrency and persistence modules, indicating a sophisticated attack designed for long-term compromise and financial gain.

CRLite and DLL Injection Improvements

  • CVE ID: Not applicable (security enhancements).
  • Severity: N/A (Proactive security improvements).
  • Affected Versions/Platforms: Mozilla Firefox.
  • Exploit Status: N/A (Feature implementations).
  • Patch/Workaround: These are built-in improvements. Ensure you are running a modern version of Firefox.
  • Details: Mozilla continues to enhance Firefox's security posture with features like CRLite, which offers faster, more private, and comprehensive certificate revocation checking. Additionally, efforts to improve enterprise stability by reducing DLL injection help mitigate a common attack vector, making Firefox more resilient against certain types of exploits.

End of Support for Older Windows

  • CVE ID: Not applicable (policy change).
  • Severity: Informational (Users on unsupported OS will face increasing security risks).
  • Affected Versions/Platforms: Firefox on Windows 7, 8, and 8.1.
  • Exploit Status: N/A.
  • Patch/Workaround: Users on Windows 7, 8, or 8.1 must upgrade their operating system to continue receiving security and feature updates for Firefox beyond version 115. Not updating the OS will leave Firefox vulnerable.
  • Details: Firefox version 115 is the last to support Windows 7, 8, and 8.1. Continuing to use Firefox on these unsupported operating systems will expose users to unpatched vulnerabilities, making them susceptible to various cyber threats.

Microsoft Edge

CVE-2025-6554: Chromium RCE Zero-Day (shared with Chrome)

  • CVE ID: CVE-2025-6554
  • Severity: Critical (Actively Exploited), potential for Remote Code Execution (RCE).
  • Affected Versions/Platforms: Chromium-based browsers, including Google Chrome and Microsoft Edge.
  • Exploit Status: Actively exploited in the wild (zero-day).
  • Patch/Workaround: Update Edge to its latest stable version.
  • Details: As a Chromium-based browser, Microsoft Edge is also affected by the CVE-2025-6554 zero-day. This vulnerability is critical due to its active exploitation and potential for remote code execution, underscoring the importance of timely updates for all Chromium-derived browsers.

Blocking Malicious Sideloaded Extensions

  • CVE ID: Not applicable (policy enhancement).
  • Severity: N/A (Proactive security measure).
  • Affected Versions/Platforms: Microsoft Edge.
  • Exploit Status: N/A (Proactive measure against future threats).
  • Patch/Workaround: This is an upcoming security feature. Users should ensure Edge is updated to receive this functionality.
  • Details: Microsoft Edge is implementing a significant security upgrade by blocking malicious sideloaded extensions. This policy change aims to curb the spread of harmful extensions that bypass official marketplaces, providing a more secure browsing experience and reducing a common attack vector.

General Security Upgrades & HTTPS First Mode

  • CVE ID: Not applicable (feature implementations).
  • Severity: N/A (Security enhancements).
  • Affected Versions/Platforms: Microsoft Edge.
  • Exploit Status: N/A.
  • Patch/Workaround: Users should update Edge regularly to benefit from these security features.
  • Details: Microsoft Edge continues to receive major security upgrades, including the introduction of "HTTPS First Mode". This feature automatically attempts to connect to websites over HTTPS, enhancing privacy and security by encrypting traffic and protecting against man-in-the-middle attacks. Other ongoing security improvements are continually integrated.

Apple Safari

Safari 26 Security Update (WebKit)

  • CVE ID: Specific CVEs not detailed in the snippet, but generally covers WebKit vulnerabilities.
  • Severity: Varies, typically includes high-severity vulnerabilities.
  • Affected Versions/Platforms: Safari 26.
  • Exploit Status: Patched vulnerabilities.
  • Patch/Workaround: Users should update to Safari 26 or later, typically by updating their macOS, iOS, or iPadOS.
  • Details: Apple regularly releases security updates for Safari, often addressing critical vulnerabilities in its WebKit rendering engine. These updates are essential to protect against various web-based attacks, including arbitrary code execution and information disclosure.

iOS/iPadOS Zero-Day (CVE-2025-43300) impacting Safari

  • CVE ID: CVE-2025-43300
  • Severity: Critical (Actively Exploited)
  • Affected Versions/Platforms: iOS and iPadOS (specific versions address the defect), impacting Safari as the default browser.
  • Exploit Status: Actively exploited in the wild (zero-day).
  • Patch/Workaround: Apple has released emergency patches for iOS and iPadOS. Users are advised to update their devices immediately.
  • Details: This zero-day vulnerability in iOS and iPadOS could allow attackers to compromise devices through Safari by visiting a malicious website. As Safari is deeply integrated into the operating system, such flaws can have far-reaching consequences for user security and privacy.

Vulnerability Linked to Chrome Zero-Day

  • CVE ID: Not explicitly stated for Safari, but linked to a Chrome zero-day (likely a shared WebKit vulnerability).
  • Severity: High/Critical (due to linkage with actively exploited Chrome zero-day).
  • Affected Versions/Platforms: Apple Safari (implied specific versions).
  • Exploit Status: Patched, but linked to an actively exploited Chrome zero-day.
  • Patch/Workaround: Apple released a patch. Users should ensure their Safari is updated.
  • Details: A vulnerability in Safari was recently patched, which was linked to an actively exploited Chrome zero-day. This suggests a shared vulnerability in the underlying WebKit engine (used by Safari) and Chromium's Blink engine (which shares some lineage with WebKit), highlighting the cross-browser impact of core rendering engine flaws.

Analyst Insights

The consistent appearance of actively exploited zero-day vulnerabilities across multiple browsers underscores a critical trend: browsers remain a primary battleground for cybercriminals and nation-state actors. The agility with which these threats emerge and are exploited demands an equally agile defense strategy.

Emphasize Urgent Patches (Zero-Days Exploited in the Wild)

The zero-days identified in Chrome (CVE-2025-10585, CVE-2025-5419, CVE-2025-6554), Firefox, and Apple's iOS/iPadOS (CVE-2025-43300 affecting Safari) are not theoretical risks; they are actively being used by attackers. This means every unpatched system is an open door for compromise. Organizations and individuals must prioritize the immediate application of these emergency patches. Waiting even a few days can expose systems to significant risk, leading to data breaches, ransomware, or other forms of malicious activity.

Actionable Recommendations for Enterprise Teams

  1. Automated Patch Management: Implement robust, automated patch management systems for all browsers and operating systems. Ensure updates are deployed swiftly and verified.
  2. Endpoint Detection and Response (EDR): Utilize EDR solutions that can detect and prevent browser-based exploits, including those leveraging zero-days, by monitoring for anomalous behavior.
  3. Browser Hardening: Configure browser security settings according to best practices. Disable unnecessary features, enforce strict content security policies, and restrict extension installations to approved lists.
  4. User Awareness Training: Regularly train employees on phishing, social engineering, and the risks associated with suspicious links and malicious extensions.
  5. Network Segmentation: Implement network segmentation to limit the lateral movement of attackers if a browser-based compromise occurs.
  6. Security Baselines: Maintain and regularly audit security baselines for all endpoints, ensuring browsers are configured securely.

Actionable Recommendations for End Users

  1. Enable Automatic Updates: Ensure all your browsers (Chrome, Firefox, Edge, Safari, Brave) are configured for automatic updates and restart them frequently to apply patches.
  2. Regularly Check for Updates: Manually check for updates daily, especially for critical browsers.
  3. Be Wary of Extensions: Only install extensions from official stores and scrutinize their permissions. Regularly review and remove any unused or suspicious extensions.
  4. Keep OS Updated: Browser security is often tied to the underlying operating system. Keep your OS (Windows, macOS, iOS, Android) updated.
  5. Use a Reputable Antivirus/Anti-Malware: Maintain up-to-date security software on all devices.
  6. Practice Safe Browsing: Be cautious about clicking unfamiliar links, downloading files from unknown sources, and entering credentials on suspicious websites.

Emerging Trends

  • Increased Zero-Day Exploitation: The sheer number of browser zero-days exploited in 2025 points to a highly active threat landscape and sophisticated attackers.
  • Focus on Core Components: Vulnerabilities in core components like the V8 JavaScript engine (Chrome) and WebKit (Safari) continue to be high-value targets due to their widespread impact.
  • Malicious Extension Ecosystem: The persistent threat of malicious extensions highlights a thriving ecosystem for distributing malware and stealing data through ostensibly benign browser add-ons.
  • Cross-Browser Vulnerabilities: Shared codebases (like Chromium) mean vulnerabilities can affect multiple browsers simultaneously, necessitating coordinated industry response and swift patching.
  • AI Integration Risks: As browsers integrate more AI features (e.g., Microsoft Edge's Copilot integrations), new attack surfaces related to prompt injection and data handling are emerging, requiring novel security controls like inline protection for AI apps.

References

Read more