Fake PDF and search tools hijacked searches for 13.4 million Chrome users
Socket tied 319 mostly unlisted Chrome Web Store extensions, promoted by ads, to query proxying toward Yahoo or Bing.
72
Product
Chrome
- Mentions · 7d18
- Mentions · 30d88
- All mentions149
- First seenAug 11, 2026
- Last mentioned7h ago
Timeline
149 articles · newest firstUnreleased Claude built exploit chains for Chrome, Safari, and major OSes
Anthropic says the model made five exploits, including Android data theft and Linux root code execution; vendors have patched.
74
319 Chrome extensions with 13.4 million installs hijacked searches
Socket says operators swapped the default search engine and proxied queries for Bing and Yahoo referral payments; most listings are now gone.
72
Explainer: three ways AI agents already control employee browsers
Debugging protocols, in-browser agents and WebMCP can act inside signed-in sessions that logs may attribute to the user.
28
319 Chrome extensions override default search without extra permissions
The decade-long set is linked to about 13.4 million reported users, a cumulative figure rather than current infections.
57
319 Chrome Extensions Hijack Searches Affecting 13.4M Users
Extensions redirect user searches via proxies to Yahoo or Bing for referral revenue, exposing queries without invasive scripts.
40
OffensiveCon Japan agenda covers Chrome, Telegram and iOS research
October 27–28 session titles name Skia, Telegram stickers and Muse Spark, but list no CVEs, versions or confirmed attacks.
28
Chrome enhanced autofill can now suggest details from Gmail
The US rollout covers desktop, Android, and iOS when Personal Intelligence is on, and users can disable it.
46
Chrome AI autofill can fill forms using Gmail details
Optional US suggestions may include confirmation numbers, membership IDs, addresses, phone numbers, and card numbers.
46
Chrome desktop before 156.0.8078.73 affected, Google advisory says
Canadian advisory AV26-1095, dated October 28, tells users to install the Stable Channel updates.
38
Google fixes 52 Chrome flaws, including four critical bugs
Stable builds move to 156.0.8078.73/.74 on Windows and Mac and 156.0.8078.73 on Linux, with no exploitation stated.
68
Chrome 156 and Firefox 159 patch more than 200 flaws
CVE-2026-118306 can run arbitrary code outside Chrome's sandbox from a crafted HTML page; no in-the-wild exploitation is mentioned.
70
Anthropic says unreleased Claude built Chrome, Android and Linux exploits
Vendors were notified first; Chrome 156 fixed 62 CVEs, and the Linux root flaw is CVE-2026-98432.
82
Unreleased Claude model wrote Chrome, Linux and Android exploit chains
Anthropic says the lab-only chains were reported first and fixed, including Chrome 156, with no real-world incidents.
74
Chrome 156 and Firefox 159 patch critical memory-safety flaws
Google shipped 52 fixes, four rated Critical, and Mozilla fixed 167 bugs; both credited AI-assisted bug finding.
64
Anthropic's unreleased model chained flaws into patched OS exploits
Lab proofs, not live attacks, covered Chrome 156, iOS 26.5.2, Windows CVE-2026-33096, and Linux CVE-2026-98432.
74
Anthropic says Claude built critical exploit chains in Chrome, Safari and Android
Google assigned 62 critical or high Chrome CVEs, patched as of Chrome 156; Apple and Google say the Safari and Android issues are fixed.
76
Project Zero: BigSleep beat Fuzzilli on V8 bugs, overlap partial
In six months BigSleep reported 45 V8 vulnerabilities to Fuzzilli's 37, and experiments put theoretical overlap near 60%.
58
eMudhra exits certificate business after weak intermediate keys
Eight intermediate keys were trivial values; browsers blocked them, and the firm says nothing was breached.
78
eMudhra ends certificate business after weak private keys cracked
Eight intermediate keys were integers below 256, one of them 4; major browsers blocked the certificates within days.
76
Chrome now asks permission before insecure HTTP connections
Nearly 95% of desktop users see no HTTP warning in a week; intranet and local IPs are exempt.
46
Chrome uses Gemini to warn on scam sites and ClickFix commands
Enhanced Protection now scores pages with a server-side Gemini model and warns before copied ClickFix commands run.
46
Chrome warns on ClickFix clipboard commands and plain HTTP
Server-side Gemini scam checks and ClickFix clipboard warnings are Enhanced Protection features; HTTP prompts are now default for everyone.
48
Chrome Enhanced Protection uses Gemini to catch update and antivirus scams
Scam scoring moved to a server-side model for every Enhanced Protection user, with separate suspicious-site warnings and ClickFix command checks.
42
eMudhra CA signing keys were so weak anyone could recover them
Eight intermediates from an April 2025 ceremony used keys under 256; browsers blocked them, and about 30,000 customer certificates need replacement.
86
Chrome 156 patches 353 flaws, six of them critical
Fixed builds are 156.0.8078.47 on Linux and 156.0.8078.47 or .48 on Windows and Mac; Google does not report active attacks.
70
eMudhra intermediate CA keys were single-byte and factorable
Eight April 2025 intermediates, also cross-signed by Sectigo, used P-384 private keys of one byte.
78
Chrome uses server-side Gemini to flag fake antivirus scams
Enhanced Protection adds scam scoring, separate suspicious warnings, and clipboard checks for ClickFix commands.
46
Chrome desktop builds before 56.0.8078.47 need updates
Canadian Cyber Centre advisory AV26-1069 covers Windows, Mac, and Linux Stable Channel releases as of October 20.
44
Chrome warns Enhanced Protection users before they run ClickFix commands
Copied commands are scrubbed and checked by Safe Browsing, and Chrome is also expanding scam and financial-ad checks.
46
Chrome 156 patches 353 flaws, mostly memory-safety bugs
Six critical issues are included; Google does not say any are exploited, and stable builds are 156.0.8078.47/.48.
64
Chrome 156 fixes 353 vulnerabilities, six of them critical
Linux builds are 156.0.8078.47 and Windows and macOS builds are 156.0.8078.47 or .48; exploitation is not addressed.
68
Browsers block eMudhra intermediate CAs with recoverable private keys
Eight April 2025 intermediates used near all-zero keys; browsers blocked them between October 17 and October 20.
78
Weak eMudhra keys expose eight trusted intermediate certificates
All eight P-384 private keys were integers below 256 and could be recovered from public certificate data.
78
Google servers can scan Chrome clipboard copies
The linked Neowin page returned only a Cloudflare bot check, so the clipboard claim is unverified here.
18
Mozilla, Google and Apple block compromised eMudhra certificates
Eight April 2025 intermediates used private keys smaller than 256; no abuse is evidenced, but many trust stores needed updates.
74
Tech giants block eMudhra certificates tied to 8 compromised keys
Six keys issued website TLS certificates and two were for code signing; fraudulent issuance is unconfirmed.
78
eMudhra intermediate CA key compromise triggers browser blocks
Eight intermediates chaining to major browser roots were blocked; attacks on users are not confirmed.
84
Chrome and Firefox drop eMudhra root after certificate compromise
Whether Edge, Internet Explorer, cURL, and other private root stores still trust eMudhra is unconfirmed.
62
Eight eMudhra intermediate CA keys compromised; browsers block them
Chrome and Firefox blocked the TLS intermediates within hours of an October 17 report, and no website certificate chaining to them was in Certificate Transparency beforehand.
86
Related CVEs
by mentions- CVE-2026-850462%8.8Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)
- CVE-2026-874914%8.8Actively Exploited Out-of-Bounds Write in Google Chrome V8
- CVE-2026-85880<1%7.8Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
- CVE-2026-528114%8.8Use-After-Free in Google Chrome's Dawn (WebGPU) Component Enables Arbitrary Code Execution
- CVE-2026-39092%8.8Out-of-Bounds Write in Google Chrome's Skia Rendering Engine
- CVE-2026-116452%8.8Out-of-Bounds Read/Write in Google Chrome V8 Enables In-Sandbox Code Execution
- CVE-2026-39103%8.8Out-of-Bounds Memory Flaw in Google Chrome V8 Allows Sandboxed Code Execution
- CVE-2026-244155%8.8Use-After-Free in Google Chromium CSS Rendering Exposes Chrome, Edge, Opera Users
- CVE-2026-95357<1%9.6GPU out-of-bounds write in Chrome for Android
- CVE-2026-330961%7.5Out-of-bounds read in Windows HTTP.sys allows an unauthorized attacker to deny service over a network
Appears with
- Googlevendor · 131
- Googleorganization · 42
- Microsoftvendor · 36
- Applevendor · 21
- Firefoxproduct · 20
- Geminiai model · 17
- Claudeai model · 14
- Windowsproduct · 14
- OpenAIorganization · 14
- V8product · 13
- Chromiumproduct · 12
- Anthropicorganization · 12
- Mozillavendor · 11
- OpenAIvendor · 11
- Androidproduct · 11
- eMudhravendor · 11
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.