Logic bugs alone escaped Microsoft Edge at a $175,000 Pwn2Own win
DEVCORE's chain needs no memory corruption and was fixed in Edge 148.0.3967.70 the day after the May contest.
55
Product
Microsoft Edge
- Mentions · 7d5
- Mentions · 30d15
- All mentions43
- First seenAug 15, 2026
- Last mentioned2d ago
Timeline
43 articles · newest firstOrange Tsai details logic-only Microsoft Edge full chain from Pwn2Own
DEVCORE used five logic bugs and two Windows features for an Edge sandbox escape, earning $175,000 and a Pwnie award.
58
Microsoft revokes trust in compromised eMudhra certificates
An October 26 Windows update drops seven certificates after weak key generation exposed eight eMudhra intermediate keys.
78
Microsoft emergency updates block compromised eMudhra certificates
Eight recoverable intermediate keys could forge TLS or code-signing certificates; Microsoft says its own systems were not affected.
73
Microsoft Windows updates remove trust in weak eMudhra certificates
October 26 updates target offline Windows systems after eight April 2025 intermediate keys proved recoverable.
74
StealC seller relaunches as Stadia RAT for Windows
Version 1.1.2 adds hidden desktop control, a shell, and a loader; Varonis ties its helper to StealC 3.5.
72
APT28 uses Hookedge and an SSH tunnel against NATO defense firms
A naval shipbuilder intrusion starting July 24, 2026 lasted at least two months and included stolen credentials.
76
ChatGPT Chrome extension can read and act across open tabs
OpenAI says the extension is on all ChatGPT plans and can fill forms, message, and organize tabs.
46
APT28 breaches NATO naval shipbuilder, deploys reflective loader
Symantec says operators stole credentials two ways, opened an SSH tunnel and ran a new in-memory loader.
78
Rust-based CikaBika Bot uses Discord as its command center
A Nim loader and PowerShell UAC bypass try to plant the payload as Edge’s dbghelp.dll.
56
Google Chrome 155 Patches Critical Use-After-Free Flaw and Nine Additional Security Bugs
Google patched ten Chrome 155 flaws, including critical Prerender use-after-free CVE-2026-110922, with no known exploitation.
68
CikaBika Bot RAT Uses Discord for C&C
Darktrace reports CikaBika, a Rust RAT using Discord for C2, delivered by phishing PDFs and LNK loaders.
58
16 Malicious Firefox Extensions Pose as Rabby and OKX Wallets to Steal Recovery Phrases
Sixteen malicious Firefox extensions impersonating Rabby and OKX wallets stole recovery phrases via Cloudflare Workers.
64
100 days later: Microsoft still steers Windows and Copilot users to Edge
Mozilla says Microsoft still steers non-EEA Windows and Copilot users toward Edge, 100 days after its report.
32
ClickFix campaign in Ukraine compromises over 100 websites to spread Lunex malware
A ClickFix campaign compromised over 100 Ukrainian websites to deliver the Lunex information stealer.
71
SectopRAT Malware Hides in Legitimate Software to Steal Browser Credentials and Crypto Wallets
SectopRAT hides in tampered legitimate software and steals browser credentials and crypto wallets.
60
Researchers Found a Windows RAT That Turns Victims’ Screens Into Live Streams
Point Wild detailed BotHelper, a Windows RAT that live-streams victim screens and tampers with AMSI.
62
Other users can watch your browsing and time your keystrokes through OS file notifications
Graz researchers showed local accounts can infer browsing and keystroke timing through OS file notifications.
62
In Other News: Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, Water Utility Exposure
Roundup: ShinyHunters defaced Cl0p’s leak site, new secret-stealing implants emerged, and US water credentials were exposed.
74
ClickFix Campaign Abuses Trusted Websites to Deploy Psychedelic Stealer
Attackers hijacked Ukrainian sites with a fake Cloudflare CAPTCHA to install Psychedelic Stealer and steal credentials.
66
Windows, Linux, Android File Notification Systems Leak User Activity
Graz researchers show OS file-change notifications can reveal other users' activity without exposing file contents.
58
CLOSEDQUORUM, the malware that asks four AI models what to do next
Cisco Talos says CLOSEDQUORUM lets four commercial AI models vote on credential and wallet theft.
74
This Windows Malware is Built to Let Up to Four AI Models Vote on Its Next Move
Talos analyzed CLOSEDQUORUM, Windows malware that lets up to four AI models vote on its next action.
68
New ClosedQuorum Windows malware uses AI for attack decisions
ClosedQuorum, a Go Windows implant, lets several LLMs choose post-compromise actions without a human operator.
62
BragJack Attack Hijacks AI Assistants in 5 Popular Browsers With Zero Clicks
Researchers disclosed BragJack, a zero-click extension attack hijacking AI assistants in Chrome, Edge, Opera, Comet, and Claude.
68
BragJack attacks hijack AI browser agents through malicious extensions
Forever Security's Gal Weizman disclosed BragJack, a malicious-extension technique hijacking AI browser agents from Chrome Gemini to Claude, earning $20,000 in bounties.
65
BragJack Attack Lets Malicious Extensions Hijack AI Agents Across 5 Major Browsers
Researchers demonstrated 'BragJack' browser-extension attacks that hijack AI agents in Chrome, Edge, Comet, Opera Neon, and Claude, leading to two CVEs and vendor patches.
68
Malware bypasses browser checks to force install Chrome, Edge extensions
Elastic Security Labs detailed KREMLIN, a Brazilian banking malware that silently installs malicious Chrome and Edge extensions, with 1,515 confirmed infections.
62
One Extension Could Hijack AI Assistants Across Chrome, Comet, Edge, Opera Neon and Claude
Researchers showed a single browser extension could hijack AI agents in Chrome, Edge, Comet, Opera Neon and Claude in Chrome, earning $20,000 in bounties.
62
KREMLIN Banking Malware Infects Over 1,500 Systems With Malicious Chrome Extension
Elastic tracks KREMLIN banking malware that used fake Brazilian bank JavaScript lures to deploy malicious Chrome and Edge extensions on 1,515 systems.
52
Novel Blue Moon kit targeting Chrome and Windows reflects new reality of AI-driven exploits
Proofpoint reports the BlueMoon exploit kit, chaining two Chrome V8 zero-days and a Windows ALPC bug, being shared across China-linked espionage groups.
85
Four groups caught using the same Chrome and Windows exploit kit
Proofpoint reports at least four hacking groups, some China-linked, share the BlueMoon exploit kit chaining Chromium and Windows kernel vulnerabilities to install malware.
80
4 groups caught using the same Chrome and Windows exploit kit
Proofpoint says at least four groups, some China-linked, actively share the BlueMoon kit chaining two Chromium and one Windows kernel exploit.
85
Patch Tuesday - September 2026
Microsoft's September 2026 Patch Tuesday fixes 999 CVEs, a record, with two zero-day privilege escalation flaws already exploited in the wild.
88
Microsoft patches a record 972 vulnerabilities, 112 of them critical
Microsoft's September Patch Tuesday fixes a record 972 vulnerabilities, 112 rated critical, including two zero-days in Windows components.
70
Counterfeit installers turn routine software downloads into enterprise breaches
Microsoft warns of a multi-sector campaign using counterfeit download sites for Edge, Kaspersky and Razer to deliver trojanized installers with persistent implants.
65
Iranian Hackers Pose as Recruiters to Deliver Cross
Kaspersky attributes new cross-platform RATs NodeRabbit and PollCat to Iranian group Nimbus Manticore, spread via recruiter-themed LinkedIn lures.
55
Counterfeit installers to system compromise: Tracking a deceptive software download campaign
Microsoft tracks a counterfeit software-installer campaign compromising multinationals' China operations, moderately linked to the Silver Fox (Yinhu) actor.
63
Russian APT BlueDelta Uses HOOKEDGE to Target Defense and Diplomatic Organizations
Russian GRU-linked BlueDelta (APT28) deployed HOOKEDGE backdoor via macro Word lures against European governments using webhook.site and Microsoft Edge for stealthy C2.
78
Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers
SpecterOps released CDP-Enable-BOF, a Beacon Object File that enables Chrome DevTools Protocol in live Chrome or Edge processes on Windows for session hijacking.
45
Related CVEs
by mentions- CVE-2026-06287%8.8Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious…
- CVE-2026-55945<1%4.2Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Edge (Chromium-based) allows an authorized attacker to…
- CVE-2026-85880<1%7.8Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
- CVE-2026-850462%8.8Actively Exploited V8 Type Confusion in Google Chrome (CVE-2026-85046)
- CVE-2026-81963<1%7.8Local Privilege Escalation via Link Following in Windows Update Stack
- CVE-2025-68788<1%—Linux kernel: fsnotify: do not generate ACCESS/MODIFY events on child for special files inotify/fanotify do not allow users…
- DOM memory corruption in Chrome before 155.0.8059.84
- Use-after-free in Chrome Prerender before 155.0.8059.84
- CVE-2026-81349<1%7.2OS Command Injection Privilege Elevation in Microsoft Azure HDInsights
- CVE-2025-277383%6.5Improper access control in Windows Resilient File System (ReFS) allows an authorized attacker to disclose information over a network
Appears with
- Microsoftvendor · 29
- Googlevendor · 21
- Google Chromeproduct · 17
- Windowsproduct · 12
- Geminiai model · 7
- Chromiumproduct · 6
- Firefoxproduct · 6
- Braveproduct · 5
- Anthropicvendor · 5
- Claudeai model · 5
- Perplexityvendor · 4
- MetaMaskproduct · 4
- Exodusproduct · 4
- ClosedQuorummalware · 4
- Cisco Talosorganization · 4
- Operavendor · 4
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.