Volexity reports China-linked UTA0560 and JungleBamboo chained Chrome zero-day CVE-2026-85046 with kernel flaws to spy on NGOs.
Volexity documented campaigns detected on September 1, 2026, in which China-linked actors UTA0560 and JungleBamboo (APT31) chained CVE-2026-85046 (V8 type confusion), CVE-2026-87491 (WebAssembly sandbox escape), and CVE-2026-85880 (Windows kernel privilege escalation in RtlpCreateServerAcl). Victims were lured via links on legitimate U.S. university sites vulnerable to reflected XSS, then served hidden exploit iframes behind a donation-form image. Although a V8 fix had landed in Chromium's source after private August reporting, Chrome had not yet shipped it, creating a patch gap the actors exploited. The two groups installed distinct payloads: UTA0560 delivered the GRIMWEDGE JScript backdoor via DLL side-loading, while JungleBamboo used the SUPERSTOMP loader to install the LONGTALE credential-stealing Chrome extension disguised as Google Gemini.
Google Search now rewrites organic result links to opaque google.com/goto redirects, raising costs for SERP scrapers including AI crawlers.
As of late August 2026, logged-out and private-mode Google SERPs consistently replace organic result hrefs with /goto?url= links using a Google-specific encoding that cannot be decoded offline; the destination URL is only revealed in the Location header of the /goto response. This differs from the older google.com/url?q= format where the target was readable in the query string. The change fits Google's broader anti-scraping push against AI crawlers and SEO scrapers, alongside removing &num=100 and tightening BotGuard/SearchGuard. SERP API vendor Autom.dev updated its pipeline to resolve goto links via HEAD requests without following redirects.
Anthropic disrupted industrial-scale unauthorized Claude distillation by seven China-based AI labs, including Alibaba, DeepSeek, Moonshot, and Z.ai.
Anthropic identified and disrupted six illicit distillation campaigns since February 2026 run by seven China-based labs: Alibaba, Moonshot, DeepSeek, Z.ai (Zhipu), MiniMax, Xiaomi, and SenseTime. The largest, GTG-16005, involved 151 million exchanges targeting Claude Opus 4.6/4.7 chain-of-thought transcripts, peaking at roughly 3 million exchanges per day from more than 3,500 fraudulent accounts. Labs used proxy/relay services with fictitious identities, fake or stolen credit cards, harvested API keys, and purchased conversation transcripts from third-party resellers. Anthropic is countering by banning reseller accounts, summarizing internal reasoning before responding, and introducing preserved thinking in Fable 5.1, which encrypts reasoning and prevents context edits before it.
Anthropic disrupted APT29-linked GTG-20006, which used Claude to autonomously rebuild malware, hijack hotel Wi-Fi DNS, and target 20-plus Ukrainian, European, and US-linked organizations.
Anthropic attributed the campaign to GTG-20006, aligned with Midnight Blizzard (APT29/Cozy Bear), which developed an AI-driven process that monitors its implants against security products and autonomously rebuilds and redeploys detected malware. Targets included military intelligence, diplomatic, and defense organizations in Ukraine and Europe, plus Middle East and Asian maritime agencies; the actor compromised at least three hotel Wi-Fi vendors via DNS hijacking and served ClickFix lures delivering Windows, Android, and iOS malware such as PowerChrome, GiftDrop, and DarkSword. Operations also included a North African breach exfiltrating over 300,000 national identity records and 500,000-plus company registry entries, an Embassy Kit device-code phishing campaign stealing Microsoft 365 tokens from at least eight organizations, and WhatsApp account takeover using headless browsers. The campaign overlaps with CaptiveCrunch reporting from ReliaQuest, Microsoft, Google, and Lumen Black Lotus Labs.
Bitdefender found thousands of Google Play Early Access apps with deceptive behavior, including ad-fraud-capable utilities requesting excessive permissions on Android devices.
Bitdefender Labs analyzed Google Play apps installed by its users and identified thousands of Early Access applications that appeared deceptive, including fake casino and reward games, misleading utilities, and apps using third-party trademarks, many promoted via social ads with AI deepfakes. Early Access apps cannot receive public reviews, removing a key warning signal users normally rely on. Some apps requested unusual permissions, such as a QR scanner seeking to replace the device launcher, which could enable hidden web views that click ads and potentially display fake login screens or capture two-factor codes. Bitdefender recommends Android Enterprise Work Profiles and notes Google Workspace admins can disable Early Access apps for their organization.
GBHackers ranks 10 CNAPP platforms for 2026, naming Wiz, Prisma Cloud, and Microsoft Defender for Cloud as category leaders.
The guide describes CNAPP as the umbrella combining CSPM, CWPP, CIEM, and DSPM, arguing that cross-pillar correlation of attack paths is the platform's core value. Wiz is ranked best for graph-based correlation, Prisma Cloud for the broadest module set, and Microsoft Defender for Cloud for Azure economics. It also cites Google's approximately $32 billion agreement to acquire Wiz, announced in March 2025, as buyer leverage and a reason to seek roadmap and neutrality protections in multi-year contracts.
2026 CSPM comparison ranks Wiz atop cloud posture tools and recaps Google's pending roughly $32 billion acquisition of Wiz.
An editorial guide rates ten cloud security posture management (CSPM) tools, with Wiz ranked first for agentless visibility and attack-path context, Microsoft Defender for Cloud highlighted for Azure-centric economics, and Palo Alto Prisma Cloud noted for the broadest code-to-cloud module set. The article's biggest market note is Google's agreement to acquire Wiz for approximately $32 billion, described as the largest deal in security history, still progressing through regulatory review. It advises buyers to include roadmap-protection language in multi-year commitments and to press on multicloud neutrality post-close.
2026 enterprise browser guide ranks Island first and notes Mammoth Cyber's wind-down plus corrections to standard vendor shortlists.
An editorial guide assesses ten enterprise browser options, ranking category creator Island first for last-mile DLP and BYOD controls, followed by Palo Alto's Talon browser as a Prisma Access/SASE surface and Google Chrome Enterprise Premium for DLP on already-deployed browsers. It corrects common lists, noting SlashNext is browser-adjacent phishing and BEC defense rather than a managed browser, and that Mammoth Cyber has wound down independent operations. Microsoft Edge for Business is positioned as effectively free policy depth for Microsoft 365 estates, with Menlo Security offering an isolation-plus-browser blend.
Cohere released North Small Translate, an open-weight 218B MoE (25B active) translation model scoring 83.6 on WMT26 across 50 languages.
Cohere and Cohere Labs released North Small Translate, a decoder-only sparse Mixture-of-Experts translation model with 218B total and 25B active parameters, 128 experts with 8 activated per token plus shared experts, and 16K-token input and output context. In Cohere's vendor-reported WMT26 evaluation, judged by GPT-5.6-Sol, it scores 83.6 averaged across 50 languages (84.36 in an agentic multi-pass mode), ahead of DeepL NextGen (81.37), Qwen 3.5 397B A17B (81.56), GLM 5.2 (76.50), and Google Translate (68.20). The model was built with RWS's Language Weaver team, post-trained specifically for translation, and reports 112 output tokens per second versus 81 for Gemma 4 31B, with long-document xCOMET-XL scores of 48.9 versus 21.3 for Google Translate. It is available free on Cohere's Chat V2 API until rate limits, with three self-hosting checkpoints including a 4-bit NVFP4 variant running on 1x B200 or 2x H100.
Google launched the Gemini app for Windows 10 and 11 globally, adding Alt+Space access, the Gemini Spark agent, and in-app image and video generation.
Google released a native Gemini desktop app for Windows, available globally on Windows 10 and 11. The app opens with an Alt+Space shortcut, delegates multi-step tasks to the Gemini Spark agent, and pulls information from Gmail and Google Drive for tasks like drafting project summaries. It also supports image generation with Nano Banana and video direction with Gemini Omni 1, with more native desktop capabilities promised over time.
Anthropic CEO Dario Amodei's wife Cami Clark once pitched Jeffrey Epstein to fund her porn startup and now informally advises the AI lab.
A Wall Street Journal report, republished by the New York Post, details the previously low-profile past of Cami Clark, wife of Anthropic CEO Dario Amodei. Before marrying Amodei in 2022, Clark co-founded a 'luxury porn' startup called Eddice and in 2012 unsuccessfully pitched Jeffrey Epstein for investment, who declined with 'Can't do sex TV.' Clark previously dated Google co-founder Eric Schmidt for about three years and later introduced him to Amodei; Schmidt became one of Anthropic's key early investors in 2021. Though Clark holds no official role at Anthropic, she reportedly acts as Amodei's strategic adviser and networker as the company moves toward a public listing that could top $2 trillion this fall.
SpecGuard detects backdoored LLM behavior at inference time using speculative decoding acceptance rates, adding no extra model computation.
Researchers propose SpecGuard, an inference-time backdoor detector that repurposes draft-token acceptance rates from speculative decoding as a detection signal at zero added model-computation cost. When a trigger shifts the target model toward attacker-controlled behavior, the clean draft model's acceptance rate changes, exposing the backdoor; the paper formalizes when this signal appears and shows suppressing it weakens the backdoor. Experiments across diverse backdoor types and model families show reliable detection, including stealthy cases invisible to input-level filters. Speculative decoding is positioned as a free, always-on monitor for frequently updated deployed models.
Research shows AP2 agent-payment signatures can be manipulated into valid but wrong carts; proposed A-VIP defense binds signed intent to purchases.
A study demonstrates Whisper attacks on the AP2 agent payment protocol, where ordinary product-description text steers shopping agents into carts that pass every cryptographic check but no longer match user intent. Using Gemini Flash-Lite models specified by AP2's default sample agents, three attacks succeeded at 90%, 56%, and 73.3%, with the vulnerability spanning seventeen Google models, three agent frameworks, cross-vendor anchors, and Google's consumer assistant. The proposed A-VIP defense treats signed intent as a capability grant, binding credential lookups to sessions and cart lines to seen listings, blocking the first two attacks with zero false positives while surfacing unauthorized spending. The authors release A-VIP code, machine-checked invariants, and AP2-WhisperBench with 1,544 evaluation scenarios.
Proofpoint documents BlueMoon exploit kit used by four espionage groups to chain Chrome V8 and Windows flaws via phishing, all now in CISA's KEV.
Proofpoint identified a shared Chrome and Windows exploit kit, BlueMoon, used by four espionage groups against Chrome on Windows within days of one another. Attacks began with phishing emails leading to web pages that exploited two Chrome V8 vulnerabilities, followed by a Windows flaw to escape browser protections and gain higher privileges. The Chrome flaws were patched in Stable on September 3 and 8, 2026, the Windows flaw was fixed in September Patch Tuesday, and all three were actively exploited and added to CISA's KEV catalog. Researchers found clues, but no conclusive evidence, that the kit was developed with AI assistance.
Hands-on review finds Meta's Muse AI agent completes shopping and email tasks but surfaces personal Instagram API data beyond user-visible ad-topic settings.
Meta launched Muse, its first agentic AI productivity assistant, which performs tasks like shopping, email management, trip planning, media generation, and creating webpages or documents via a cloud-based virtual computer. The Verge's hands-on found it successfully deleted thousands of promotional emails and completed an Amazon purchase, but it also revealed detailed personal interests inferred from Instagram and Facebook account API data that is not visible in the apps' ad-topic settings. Meta says Muse only exchanges data needed for third-party integrations and does not share information with advertisers; the reviewer frames privacy unease as the main adoption hurdle.
CVE-2026-87464 is a critical use-after-free in Chrome's WebGL allowing sandbox-escaping RCE via crafted HTML pages, fixed in 153.0.8010.36.
Google Chrome prior to 153.0.8010.36 contains a use-after-free in WebGL that allows a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. Google rates it as Chromium security severity Critical, though tracker details are restricted. Debian indicates all current Chromium packages are affected, and the flaw likely impacts Chromium-derived browsers. No active exploitation is mentioned in the disclosure.
Bitdefender reports deceptive Google Play Early Access apps use deepfake celebrity ads and fake rewards to lure users into ad-fraud schemes.
Bitdefender research describes widespread abuse of Google Play's Early Access program, where developers publish deceptive apps that avoid public ratings and reviews. The apps are promoted through TikTok and Facebook ads promising cash rewards, PayPal payouts, crypto earnings, or gift cards, often using deepfakes of celebrities, but users receive only aggressive advertising. Examples include 'Chicken Road' and 'Ice Fishing' casino-style games plus trademark abuse such as apps named 'Grand Theft Auto V (Early Access)' that are later renamed. No malware is delivered, but some listings show thousands of installs.
Group-IB reports the Gigabud Android banking trojan uses a cloned work profile to hide from banking app malware checks, with infections confirmed in Indonesia.
Group-IB says Gigabud installs a helper app called Vwork, derived from the open-source Shelter tool, which creates an Android work profile and drops a tampered banking app inside it, hiding the trojan from banking apps' malware scans. Gigabud, active since 2022 and linked by Group-IB to the GoldFactory group, abuses Accessibility access and overlay screens to steal credentials and run fraudulent payments while a black screen conceals the operator's actions. Group-IB confirmed the full attack chain on infected devices in Indonesia, counting about 1,469 compromised devices and estimated losses of roughly $960,000 between February and July 2026. Vwork-compatible Gigabud samples have been found targeting 11 countries including Brazil, Mexico, Indonesia, Thailand, and Türkiye, though only the Indonesian chain is confirmed.
Google shipped Chrome 153.0.8010.36/.37 fixing 230 flaws including actively exploited V8 out-of-bounds write CVE-2026-87491 enabling sandboxed code execution.
Chrome stable channel updated to 153.0.8010.36/.37 for Windows and Mac and 153.0.8010.36 for Linux, including 230 security fixes. CVE-2026-87491 is an out-of-bounds write in Chrome's V8 JavaScript engine that a crafted HTML page can exploit to execute arbitrary code inside the browser sandbox; Google rates it medium severity, but it is confirmed as actively exploited. The update also fixes five Critical vulnerabilities, four of which were found in WebGL. Users should update via Settings > About Chrome and restart the browser.
OPAQUE releases Weight Custody Manifest, an open standard keeping AI model weights encrypted until receiving hardware cryptographically attests to builder-specified conditions.
OPAQUE, a confidential computing company, released the Weight Custody Manifest (WCM) standard as a developer-preview specification with a Python SDK and a public test suite of 91 cases. WCM keeps model weights encrypted until the receiving infrastructure proves via CPU/GPU attestation that it matches builder-signed conditions, and decryption access can be revoked later if conditions change. OPAQUE says it ran the attestation exchange on an NVIDIA H100 and on AMD and Intel confidential servers hosted on Azure and Google Cloud, with two independent SDK builds producing identical output across 5,948 files. The public quickstart only exercises protocol logic on synthetic evidence and skips GPU cryptographic verification, and the standard cannot distinguish an authorized key from one physically extracted from hardware.
Google open-sourced Mantis, an Apache-2.0 modular skills toolkit that lets AI coding agents find, reproduce, and patch vulnerabilities with sandboxed verification.
Google released Mantis on GitHub under Apache 2.0 as a stack-agnostic set of slash-command skills that chain through the full vulnerability lifecycle: mining version history, building threat models, filtering findings, reproducing bugs in gVisor or network-disabled VMs, assembling exploit chains, patching, and scoring residual risk from 1 to 10. It runs with Gemini CLI, Antigravity CLI, the Google ADK, or comparable agent frameworks, and a supervisor skill (/mantis-meta-agent) can drive the whole loop. Google says the design targets the sub-7 percent true-positive rate of naive AI code scanning, and that its hierarchical summary tree cuts token overhead by over 85 percent. The toolkit is deployable for local and internal evaluation but not yet recommended for production.
South Park creators rename the show's 29th season 'South America' to satirize President Trump's renaming of the Gulf of Mexico and Lake Ontario.
Matt Stone and Trey Parker announced the animated series will be called 'South America' for its new season, citing Apple and Google's compliance with Trump's renaming orders. The announcement followed the show's Emmy win for Outstanding Animated Program. The piece also references the paused $111bn Paramount Skydance-Warner Bros Discovery merger and an AI-generated Trump video. The new season premieres on 16 September.
Iran-linked Mirage Kitten targets software engineers with fake LinkedIn recruiter coding tests deploying new NodeRabbit and PollCat RATs.
Kaspersky researchers link the campaign to Mirage Kitten (also tracked as UNC1549, Smoke Sandstorm, Nimbus Manticore), with victims in aviation, aerospace and fintech in Egypt, Ethiopia and Afghanistan. Trojanized npm dependencies (colorized_terminal, pretty-log) bundled in coding-challenge archives launch the Node.js implants across Windows, Linux and macOS. NodeRabbit uses AES-256-GCM-encrypted C2 via Azure, and its third variant persists through a fake GitHub Copilot Helper VS Code extension plus Git post-merge/post-checkout hooks. PollCat is an obfuscated JavaScript RAT that registers with C2 before OTP authentication and inventories tools from 24 security vendors.
Help Net Security's September 1, 2026 roundup lists cybersecurity job openings at Google, Barclays, HUMAN and others across the US, Europe and Asia.
The weekly jobs roundup lists openings including a Google Security Engineer (Professional Services) role in the USA, a Cryptography Operations Engineer at Barclays in the UK, a Backend Engineer at HUMAN in Israel, and an AI Security Engineer at CPX in the UAE. Other listed roles span SOC analysis, SIEM engineering, cloud security, and network security across the USA, Ireland, India, Italy and Australia.
Google patched 230 vulnerabilities, including the seventh actively exploited Chrome zero-day of 2026.
Google released fixes for 230 vulnerabilities on Tuesday, including a Chrome zero-day that is being actively exploited in attacks. This is the seventh actively exploited Chrome zero-day patched since the start of 2026.
Google released Chrome 153 with 230 security fixes, patching CVE-2026-87491, a V8 out-of-bounds write zero-day actively exploited in the wild.
Google shipped Chrome 153 (153.0.8010.36/.37) for Windows, macOS, and Linux with 230 security fixes, including CVE-2026-87491, a medium-severity V8 out-of-bounds write being exploited in the wild. The release also fixes five critical vulnerabilities: four in WebGL (two use-after-frees, an out-of-bounds write, a buffer overflow) and one use-after-free in Cast. High-severity V8 use-after-free and type-confusion defects are among the fixes, and Google has restricted technical details until most users are patched. Administrators should verify deployed versions on managed endpoints, as Chrome-derived browsers may follow different patch schedules.
Threat actors chain multiple legitimate Google service redirects to evade detection and deliver credential harvesting or ScreenConnect remote access tooling.
Threat actors are abusing multiple legitimate Google services to build multi-hop redirect chains that obscure the final destination and bypass reputation-based filtering. The campaign culminates in credential harvesting pages or silent installation of the ScreenConnect remote access tool. Defenders should watch for links that traverse trusted Google domains before landing on malicious endpoints.
NSA, CISA, and FBI jointly accuse Chinese AI firms including DeepSeek and Moonshot AI of industrial-scale distillation of US frontier models.
A joint advisory from the NSA, CISA, and FBI alleges China-based AI companies including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI have systematically extracted capabilities from US frontier models since at least late 2024. The companies allegedly spent billions of tokens across millions of requests against Claude, ChatGPT, Gemini, and Grok, routing traffic through multiple accounts, platforms, proxies, and third-party aggregators to evade detection. Moonshot AI allegedly distilled 18 US models, including Anthropic's most advanced model, to train its Kimi-K2 and Kimi K3 models.
Meta launched Muse, a free personal AI agent in the US that autonomously shops, emails, and plans trips, powered by its in-house Muse Spark model.
Meta unveiled Muse, a consumer personal AI agent that handles tasks like online shopping, emailing, and trip planning, continues working in the background, and requests approval for purchases. It launches in the US on iOS, Android, and muse.ai, is free for most users with unspecified paid tiers, and runs on Meta's in-house Muse Spark model. Muse executes on a cloud virtual machine with a Sentinel agent policing outbound actions, and Meta promises an encrypted confidential VM later this year plus 1Password, Shop Pay, and Stripe Link support. The launch is positioned as the centerpiece of Meta's effort to catch up with OpenAI, Anthropic, and Google.
Google launched WeatherNext 3, an AI weather model using raw satellite data that beats ECMWF and now powers Search, Gemini, and Maps.
Google released WeatherNext 3, an AI weather forecasting model that incorporates physical surface information (land/ocean type and elevation) to improve surface temperature and dewpoint calculations, improving point location temperature accuracy by up to 30 percent. Its white paper reports roughly 5 percent better upper-atmosphere accuracy than WeatherNext 2, equating to about six additional hours of forecast lead time, outperforming the ECMWF AI model on these metrics. The model now supplies forecast information across Google Search, Gemini, and Maps, though the paper notes unexplained short-lead degraded results and grid-shaped artifacts in some predictions.
University of Toronto researchers present GPUThor, a Rowhammer attack that defeats ECC on NVIDIA RTX A4000-A6000 GDDR6 GPUs and achieves host root access.
GPUThor uses non-uniform hammering to bypass Target Row Refresh and overcome SECDED ECC on NVIDIA Ampere workstation GPUs with GDDR6 memory, inducing 72,000 to 377,552 bit flips per gigabyte across RTX A6000, A5000, A4500, and A4000 cards. Triple-bit silent data corruption enables host privilege escalation to root with the IOMMU enabled, reusing GPUBreach page-table corruption techniques, and double-bit DUEs allow escalation when the IOMMU is disabled during a ~10 ms lazy-service window. The attack cut end-to-end escalation time on the A6000 from 21.9 hours to 1.1 minutes. Reported to NVIDIA, Google, Microsoft, and AWS on April 29, 2026; findings were embargoed until August 25, 2026, and no CVE identifier was assigned.
Google switches Chrome to two-week release cycles starting with Chrome 153, shrinking the N-day patch gap as AI-driven threats accelerate.
Chrome officially moved from a four-week to a two-week release schedule with Tuesday's launch of Chrome 153 on desktop, iOS, and Android. Google ties the change to its evolving security strategy, saying faster releases shrink the N-day patch gap as AI tools and community bug reports increase patch volume. Mozilla, Microsoft, and Brave have already adopted the two-week cadence, and Google is also racing AI-native browsers like Brave, Dia, Opera Neon, and Perplexity's Comet while experimenting with AI features in Chrome.
Interconnects surveys new open models—Motif-3, GLM-5.3, Hy4-preview—while analyzing a licensing split: Western labs opening up, Chinese frontier labs getting restrictive.
The roundup covers Motif-3 (MIT license, strong scores for its size), GLM-5.3 (switched from MIT to a custom license with a $10 billion revenue threshold and undefined 'affiliates' clause requiring Z.AI security review), and Tencent's Hy4-preview (competent but prone to overthinking). It also notes dots3-note-prev from RedNote/Xiaohongshu (won IMO 2026 with a perfect score), Qwen3.8-Flash-Next (125B-A6B with GDN and Qwen Sparse Attention), NVIDIA Nemotron-3.5-Lightning-30B-A3B-BF16, and Ling-3.0-flash. The core theme: Google and Meta adopted Apache 2.0 while Chinese frontier labs (Zhipu, Kimi K3, MiniMax M3) adopted restrictive commercial licenses.
Google Threat Intelligence's Q3 2026 tracker shows threat actors using AI agents for autonomous credential harvesting, including a six-hour campaign compromising thousands of credentials.
Google Threat Intelligence Group's Q3 2026 AI Threat Tracker, based on Mandiant incident response and platform telemetry, documents adversaries shifting toward AI-driven multi-step attack workflows. Mandiant investigated a financially motivated actor that compromised cloud infrastructure and used an AI coding chatbot plus agent instructions to run vulnerability scanning, troubleshooting, and IP rotation autonomously, harvesting thousands of third-party credentials in under six hours; an exposed 'Recon' C2 server held over 23,800 harvested secrets including cloud and AI API keys. Separately, two PRC-nexus espionage actors experimented with Gemini, Claude, and Codex to build automated penetration testing and exploitation frameworks, with Shai-Hulud used for C2 and credential harvesting. GTIG says no fully autonomous attack pipelines have yet been observed in the wild.
Google Threat Intelligence Group warns threat actors increasingly target AI coding tools and proprietary AI data, with UNC6780's Dustmaker enabling large-scale supply chain compromises.
Google Threat Intelligence Group's September 8 report says AI-assisted coding tools have become prime targets, contributing to large-scale software supply chain compromises in 2025 and early 2026. Financially motivated group UNC6780 used its Dustmaker credential stealer to extract tokens from GitHub Actions runner memory and compromise packages across PyPI, npm, and Docker Hub, then sold harvested AI tool credentials to other criminals. Chinese nation-state actor UNC6508 conducted espionage against proprietary AI research at North American academic, medical, and military institutions, while extortion gangs stole models, prompts, and source code in Q2 2026. GTIG also documented agentic attacker experimentation, including an autonomous multi-agent credential harvesting campaign built in under six hours and a 'Recon' C2 framework managing over 23,800 harvested secrets.
Google/Mandiant profile Breeze Comet, a Brazil-based e-crime group executing fraudulent Pix and STR payment transactions at banks, retailers, and fintechs.
Google Threat Intelligence Group and Mandiant describe Breeze Comet (formerly UNC5669), a financially motivated threat actor active since September 2023 targeting Brazilian financial services, retail, and e-commerce. The group gains access via password spraying, vishing impersonating IT support to install RMM tools like AnyDesk, WhatsApp social engineering, and exploitation of vulnerable JBoss AS servers for web shell deployment. It uses compromised government websites as C2, deploys the Rust-based COBALTSPIN tunneler and multiple custom backdoors (LIGHTPAINT, MILDFROST, KICKPLATE, BOATBEAM), then clears logs after executing hundreds of fraudulent transactions through Pix, STR, and Boleto payment systems. At least one heist yielded tens of thousands of dollars, with infrastructure suggesting expansion toward Latin America and Africa.
Arctic Wolf tracks PREY-0058 (linked to UNC6671), a vishing campaign stealing Microsoft 365 session tokens via AiTM panels for SaaS data theft and extortion.
Arctic Wolf is tracking a campaign, PREY-0058, sharing tradecraft with Google Threat Intelligence Group's UNC6671, in which callers posing as internal IT talk employees through fake passkey/MFA setups. Operator-controlled adversary-in-the-middle pages harvest passwords and MFA approvals to seize session tokens, then actors enumerate and bulk-exfiltrate data from SharePoint, OneDrive, Exchange, and Box. Extortion brands include BlackFile, Pink, Helix, Cinder, and Redact; targets are mostly US-based executives in construction, healthcare, real estate, finance, and professional services, with exfiltration shifting to residential proxies like NodeMaven.
Proofpoint appointed Brian Levey as Chief Legal Officer and Puja Jaspal as Chief People Officer, strengthening its executive leadership team.
Proofpoint announced on September 8, 2026 the appointments of Brian Levey as Chief Legal Officer and Puja Jaspal as Chief People Officer. Levey previously served as Chief Business Affairs & Chief Legal Officer at Upwork and spent 13 years at eBay; Jaspal was Chief People Officer at Fastly with prior senior roles at Cisco, Visa, and Google. The hires support Proofpoint's stated expansion around human and AI-agent security.
Researchers show IICL structural jailbreaks generalize to Google Gemini, lifting attack success to 80-100% on harm and financial benchmarks; non-English prompts attenuate it.
The study red-teams two Google Gemini models with Involuntary In-Context Learning (IICL), a structural jailbreak reframing harmful requests as the final cell of a data-labeling task. IICL lifts attack success from at most 6.7% to 80-90% on HarmBench and 97-100% on financial abuse (FinProof), an order of magnitude above prior results on OpenAI's GPT-5.4. Against a compounding hypothesis, forcing IICL output into Spanish, Hindi, or Arabic attenuates the attack in 11 of 12 conditions, attributed to a 'relevance curse' producing lower-quality harmful content in lower-resource languages. Findings replicate under an independent non-Google judge (Cohen's kappa 0.86 over 377 paired verdicts).
Google patches actively exploited Chrome zero-day CVE-2026-85046, a V8 type confusion bug enabling sandboxed code execution via crafted HTML pages.
Google patched 12 Chrome vulnerabilities, including CVE-2026-85046, a CVSS 8.8 type confusion flaw in the V8 JavaScript and WebAssembly engine exploited in the wild. The bug, reported by researcher Salvatore Gulizia (Serotav) on August 4, 2026, allows arbitrary code execution inside the sandbox via a crafted HTML page; the researcher described it as a V8 compiler bug enabling arbitrary read/write on the JavaScript heap. Fixes shipped in Chrome 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux, and this is the sixth Chrome zero-day Google has fixed in 2026.
Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)
Google Chrome versions prior to 152.0.7977.82 contain a type confusion flaw (CWE-843) in the V8 JavaScript engine, which mishandles object types during engine operations (public proof-of-concept writeups indicate it is reachable through array sorting and WebAssembly-related code paths). A remote attacker triggers the flaw simply by getting a user to open a crafted HTML page, with no privileges or authentication required. Successful exploitation lets the attacker execute arbitrary code inside the browser's sandbox, and public reporting shows it being chained with Windows zero-days (the 'BlueMoon' exploit kit) by Chinese espionage groups for broader compromise. Any user of an unpatched Chrome or another build embedding the affected V8 engine is exposed. The vulnerability is a zero-day that was actively exploited in the wild before patching, was added to CISA's KEV on 2026-09-04, and has five public proof-of-concept references.
· Google Chrome prior to 152.0.7977.82 · Google Chromium V8 V8 engine versions bundled with Chrome prior to 152.0.7977.82 KEV PoC ×5mass
Use-After-Free in Google Chromium CSS Rendering Exposes Chrome, Edge, Opera Users
CVE-2026-2441 is a use-after-free (CWE-416) in Google Chromium's CSS handling that a remote attacker can trigger by getting a user's browser to process a crafted HTML page, potentially corrupting the heap. Successful exploitation yields a memory-corruption primitive in the browser; CVSS scoring is not yet available, but Chromium memory-safety flaws of this class can range from crashes to potential code execution depending on how the corruption is leveraged. Anyone running Chromium or a Chromium-based browser — Google Chrome, Microsoft Edge, Opera, and numerous embedded/branded browsers — is potentially affected, making the exposed population effectively all modern browser users. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2026-02-17, confirming it is being exploited in the wild; EPSS assigns a 22% probability of exploitation within 30 days (98th percentile), no public PoC is known, and any ransomware association is unknown. This lands amid an accelerating series of actively exploited Chrome zero-days in 2026 described in recent reporting, making rapid patching urgent.
· Google Chromium · Google Chrome (Chromium-based) KEV PoC mass
Actively Exploited Out-of-Bounds Write in Google Chrome V8
CVE-2026-87491 is an out-of-bounds write (CWE-787) in the V8 JavaScript engine in Google Chrome, fixed in Chrome 153.0.8010.36, which Google shipped alongside roughly 230 other security fixes. An attacker can trigger the flaw remotely by luring a user (user interaction required) into opening a crafted HTML page that corrupts memory in V8. Successful exploitation allows the attacker to execute arbitrary code inside the Chrome browser sandbox, which constrains but does not eliminate the impact. All Google Chrome users running versions prior to 153.0.8010.36 are affected; because the flaw resides in V8, CISA tracks it as 'Google Chromium V8', and other Chromium-based browsers may inherit the fix in their own updates. The flaw is being actively exploited in the wild — it is the seventh actively exploited Chrome zero-day of 2026 and was added to CISA's KEV catalog on 2026-09-09 — though no public proof-of-concept is known and ransomware use is unknown.
· Google Chrome (V8 JavaScript engine; tracked by CISA as 'Google Chromium V8') prior to 153.0.8010.36 KEVmass
Out-of-Bounds Write in Google Chrome's Skia Rendering Engine
CVE-2026-3909 is an out-of-bounds write (CWE-787) in the Skia graphics rendering library used by Google Chrome, which Google patched in Chrome 146.0.7680.75. A remote attacker can trigger the flaw by luring a user to visit a crafted HTML page, causing out-of-bounds memory access in the browser process; the High CVSS 8.8 score with high confidentiality, integrity, and availability impact indicates memory corruption with potentially serious consequences. All Google Chrome installations running versions prior to 146.0.7680.75 are affected, and because the vulnerability resides in the Skia engine, the vulnerable code is present in every Chrome install. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 2026-03-13, indicating exploitation in the wild, though no public proof-of-concept is known and ransomware use is unknown. EPSS currently assigns a 1.6% probability of exploitation within the next 30 days (75th percentile).
· Google Chrome (Skia rendering engine) all versions prior to 146.0.7680.75 · Google Skia (as shipped in Google Chrome, per CISA) prior to Chrome 146.0.7680.75 KEVmass
Use-After-Free in Google Chrome's Dawn (WebGPU) Component Enables Arbitrary Code Execution
CVE-2026-5281 is a use-after-free vulnerability in Dawn, the WebGPU implementation in Google Chrome, that Google patched in Chrome 146.0.7680.178. It is triggered when a remote attacker serves a crafted HTML page and can leverage it after having already compromised the Chrome renderer process, escalating to arbitrary code execution beyond the initial foothold. Because the flaw requires a compromised renderer as a starting point, it is typically chained with another bug (such as a renderer-exploiting issue) to break out to arbitrary code execution with real impact on confidentiality, integrity, and availability. Any user or organization running Google Chrome on a version prior to 146.0.7680.178 is affected. The flaw is confirmed as exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-04-01, and its EPSS score of 4.9% (92nd percentile) indicates a meaningful near-term exploitation probability.
· Google Chrome prior to 146.0.7680.178 · Google Dawn (WebGPU implementation bundled in Chrome) as shipped in Chrome prior to 146.0.7680.178 KEVmass
Out-of-Bounds Read/Write in Google Chrome V8 Enables In-Sandbox Code Execution
CVE-2026-11645 is an out-of-bounds read and write (CWE-125/CWE-787) in V8, the JavaScript engine used by Google Chrome and Chromium. A remote attacker triggers the flaw by luring a user to a crafted HTML page, where malicious script causes V8 to read and write outside allocated memory buffers. Successful exploitation allows the attacker to execute arbitrary code inside the browser's security sandbox, providing limited privileges within that process rather than full system compromise. All Google Chrome versions prior to 149.0.7827.103 are affected, along with the Chromium V8 component identified by CISA. The flaw is being exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-06-09, and related headlines describe an actively exploited Chrome V8 zero-day, though no public proof-of-concept is known and ransomware use is unconfirmed.
· Google Chrome prior to 149.0.7827.103 · Google Chromium V8 (as shipped in Chrome) prior to the 149.0.7827.103 Chrome release KEVmass
Out-of-Bounds Memory Flaw in Google Chrome V8 Allows Sandboxed Code Execution
CVE-2026-3910 is an out-of-bounds memory flaw — CISA classifies it as improper restriction of operations within the bounds of a memory buffer — caused by an inappropriate implementation in the V8 JavaScript and WebAssembly engine used in Google Chrome. A remote attacker triggers it by luring a user to a crafted HTML page, so exploitation requires user interaction but no privileges or special conditions. Successful exploitation allows the attacker to execute arbitrary code inside the Chrome sandbox, which confines the compromise to the renderer process rather than the full system, but still exposes data and credentials handled within the browser session. Anyone running Google Chrome prior to 146.0.7680.75 — or a Chromium-based browser that embeds the vulnerable V8 code — is affected. The flaw is being actively exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2026-03-13, and it comes amid a string of actively exploited Chrome V8 zero-days that Google has fixed during 2026.
· google chrome prior to 146.0.7680.75 (fixed in 146.0.7680.75) KEVmass
Use-After-Free in WebGL in Google Chrome Allows Code Execution Outside the Sandbox
CVE-2026-87464 is a use-after-free (CWE-416) in the WebGL component of Google Chrome affecting versions prior to 153.0.8010.36. A remote attacker can trigger it by luring a user to open a crafted HTML page, which corrupts memory in the browser's WebGL rendering path. Successful exploitation allows arbitrary code execution outside the browser sandbox, meaning the attacker escapes Chrome's process isolation and runs code with the privileges of the browser on the host. All Chrome users running an unpatched version before 153.0.8010.36 are affected. As of now there is no public proof-of-concept and this specific flaw is not in CISA KEV, although the Chrome 153 release headlines reference a separate V8 zero-day that was exploited in the wild.
· google chrome all versions prior to 153.0.8010.36mass
Sandbox-Escaping Buffer Overflow in Google Chrome ANGLE on Windows
Google Chrome on Windows prior to 153.0.8010.36 contains a buffer overflow (CWE-122) in ANGLE, the graphics shader-translation layer Chrome uses for WebGL and GPU rendering. A remote attacker can trigger the flaw by persuading a user to open a crafted HTML page, causing memory corruption in the ANGLE component. Successful exploitation allows the attacker to execute arbitrary code outside the Chrome sandbox, meaning code runs with broader host-level privileges rather than being confined to the browser renderer. All Chrome users on Windows running affected builds are exposed; the advisory scope does not state impact for other operating systems. The flaw carries a Chromium 'High' severity rating and a critical CVSS 9.6 score; EPSS currently estimates only a 0.3% chance of exploitation in the next 30 days and it is not in CISA KEV, but release coverage of Chrome 153 reports a zero-day exploited in the wild, though public confirmation tying that activity to this specific bug is limited.
· google chrome Chrome on Windows prior to 153.0.8010.36mass
Use-After-Free in Google Chrome's V8 Engine Allows In-Sandbox Memory Disclosure
CVE-2026-87657 is a use-after-free (CWE-416) in the V8 JavaScript engine of Google Chrome, fixed in Chrome 153.0.8010.36 as part of a release containing 230 security fixes. A remote attacker triggers the flaw via a crafted HTML page that causes the memory-reuse error in V8, and the bug is exploitable only after the attacker has already compromised the renderer process. Successful exploitation lets the attacker read memory inside the Chrome sandbox, an information-disclosure impact limited to confidentiality with no indication of privilege escalation or code execution outside the sandbox (CVSS 3.1: 3.1, Medium Chromium severity). Anyone running Chrome prior to 153.0.8010.36 is affected, which effectively means nearly the entire Chrome install base until updates are applied. Related reporting on the Chrome 153 release mentions a zero-day exploited in the wild, but no public proof-of-concept exists, the flaw is not in CISA KEV, and the available data does not confirm whether this specific CVE is the actively exploited one.
· Google Chrome All versions prior to 153.0.8010.36mass
Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.