Search: “browser-isolation”

25 stories

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Exploit / PoC 1 Policy & legal 1

SeverityAll critical 0 high 0 medium 1 low 1 info 0

Smart search ranks by meaning as well as keywords (one row per story, last 45 days).

One Exploit Chain, Two Espionage Campaigns: Chrome and Windows Under Fire

Two China-linked APT groups reused identical Chrome/Windows zero-day chain against NGOs, deploying GRIMWIDGE backdoor and LONGTALE credential-stealing extension.

Volexity reports that China-linked actors UTA0560 and JungleBamboo (APT31/TA412) ran byte-identical Chrome/Windows exploit chains against NGOs starting September 1, 2026, combining Chrome type confusion CVE-2026-85046, WebAssembly sandbox escape CVE-2026-87491, and Windows kernel flaw CVE-2026-85880. The Chrome bug was fixed in Chromium source but not yet shipped to Chrome users, making it an effective zero-day with an unusual patch gap. UTA0560 delivered the in-memory GRIMWEDGE JScript backdoor, while JungleBamboo deployed the SUPERSTOMP loader installing LONGTALE, a malicious Chrome extension disguised as Google Gemini that steals cookies, session tokens, and keystrokes. Volexity assesses with low confidence the exploit chain was sold or shared among different Chinese end-users.

Security AffairsSep 15, 10:17 UTC · 1d agoThreat actor in the wild 23 sources CVE-2026-85046 CVE-2026-87491 CVE-2026-858804

12 Best Browser Isolation Solutions Compared (2026): Features & Pricing

2026 comparison ranks Zscaler, Cloudflare, Menlo Security, Garrison (Everfox), Authentic8 and Kasm among twelve remote browser isolation solutions.

Guide compares twelve RBI products across four architectures: pixel streaming, DOM/vector reconstruction, platform-embedded SSE isolation, and self-hosted containers. Zscaler and Cloudflare lead RBI delivered inside SSE platforms, while Menlo Security leads isolate-everything efficacy and Garrison (Everfox) provides hardware-grade isolation for government use. Most offerings price per user per month.

GBHackersSep 15, 06:27 UTC · 1d agoTools

Chrome V8 Zero-Day Exploited in the Wild Enables Code Execution Inside Sandbox

Google patches actively exploited Chrome V8 zero-day CVE-2026-87491, an out-of-bounds write enabling sandboxed code execution via crafted HTML pages.

Google released Chrome 153.0.8010.36/.37 fixing 230 vulnerabilities, including CVE-2026-87491, an out-of-bounds write in the V8 engine that allowed remote code execution inside the sandbox via a crafted HTML page and is confirmed to be exploited in the wild. The flaw was reported on August 6, 2026 by Jihyeon Jeong of Compsec Lab, Seoul National University, who received a $2,500 bug bounty. This is the seventh actively exploited Chrome zero-day of 2026. The update also fixes five critical flaws in WebGL and Cast, plus a high WebPackaging use-after-free (CVE-2026-87639) credited to OpenAI Codex Security.

The Hacker NewsSep 9, 09:11 UTC · 7d agoExploit / PoC in the wildCVE-2026-87491 CVE-2026-2441 CVE-2026-3909+10 CVEs

Google fixes the sixth actively exploited Chrome zero

Google patched 12 Chrome flaws including actively exploited V8 type confusion zero-day CVE-2026-85046 (CVSS 8.8), enabling sandboxed remote code execution via crafted webpages.

Google released Chrome Stable 152.0.7977.82/.83 for Windows and Mac and 152.0.7977.82 for Linux, fixing 12 vulnerabilities including CVE-2026-85046, a type confusion in V8 with a CVSS score of 8.8. Google says an exploit exists in the wild, making this the sixth actively exploited Chrome zero-day of 2026. The bug affects the JavaScript and WebAssembly engine and allows arbitrary code execution inside the browser sandbox via a specially crafted HTML page. Researcher Salvatore Gulizia (Serotav) reported the flaw on August 4, 2026 and received a $1,000 bounty.

Security AffairsSep 4, 08:24 UTC · 12d agoExploit / PoC in the wildCVE-2026-85046 CVE-2026-2441 CVE-2026-3909+3 CVEs1

Google patches actively exploited Chrome zero-day (CVE-2026-85046)

Google patches actively exploited Chrome zero-day CVE-2026-85046, a V8 type confusion bug enabling sandboxed code execution via crafted HTML pages.

Google patched 12 Chrome vulnerabilities, including CVE-2026-85046, a CVSS 8.8 type confusion flaw in the V8 JavaScript and WebAssembly engine exploited in the wild. The bug, reported by researcher Salvatore Gulizia (Serotav) on August 4, 2026, allows arbitrary code execution inside the sandbox via a crafted HTML page; the researcher described it as a V8 compiler bug enabling arbitrary read/write on the JavaScript heap. Fixes shipped in Chrome 152.0.7977.82/.83 for Windows and macOS and 152.0.7977.82 for Linux, and this is the sixth Chrome zero-day Google has fixed in 2026.

Help Net SecuritySep 8, 06:24 UTC · 8d agoExploit / PoC in the wildCVE-2026-85046 CVE-2026-2441 CVE-2026-3909+3 CVEs

Google Chrome Zero-day Vulnerability Exploited in the Wild (CVE-2026-87491)

Google patched actively exploited Chrome V8 out-of-bounds write CVE-2026-87491; CISA added it to KEV with a September 23 patch deadline.

Google fixed 230 Chrome vulnerabilities in its stable channel update, including CVE-2026-87491, an out-of-bounds write in the V8 JavaScript engine being exploited in the wild. The flaw, reported by Jihyeon Jeong of Compsec Lab, Seoul National University, is the seventh Chrome zero-day patched by Google in 2026. It affects Chrome versions before 153.0.8010.36, and CISA added it to the Known Exploited Vulnerabilities Catalog urging patching before September 23, 2026. Users should upgrade to Chrome 153.0.8010.36 (Linux) or 153.0.8010.36/.37 (Windows/Mac); Qualys customers can detect vulnerable assets with QID 388666.

Qualys ThreatPROTECTSep 10, 05:14 UTC · 6d agoExploit / PoC in the wildCVE-2026-87491 CVE-2026-2441 CVE-2026-3909+4 CVEs

Update Chrome now to protect against an actively exploited vulnerability

Google shipped Chrome 153.0.8010.36/.37 fixing 230 flaws including actively exploited V8 out-of-bounds write CVE-2026-87491 enabling sandboxed code execution.

Chrome stable channel updated to 153.0.8010.36/.37 for Windows and Mac and 153.0.8010.36 for Linux, including 230 security fixes. CVE-2026-87491 is an out-of-bounds write in Chrome's V8 JavaScript engine that a crafted HTML page can exploit to execute arbitrary code inside the browser sandbox; Google rates it medium severity, but it is confirmed as actively exploited. The update also fixes five Critical vulnerabilities, four of which were found in WebGL. Users should update via Settings > About Chrome and restart the browser.

Malwarebytes LabsSep 10, 10:52 UTC · 6d agoExploit / PoC in the wild 2 sources CVE-2026-874911

Google Releases Chrome Update to Patch Actively Exploited V8 Zero-Day

Google patches actively exploited Chrome V8 zero-day CVE-2026-85046 (CVSS 8.8); CISA adds it to KEV with a September 18 deadline.

Google fixed 12 Chrome vulnerabilities, including CVE-2026-85046, a high-severity (CVSS 8.8) type confusion bug in the V8 JavaScript and WebAssembly engine. The flaw, reported by researcher Salvatore Gulizia on August 4, 2026, allows remote arbitrary code execution inside the browser sandbox via a crafted HTML page. Google confirmed the exploit exists in the wild, and CISA added the CVE to its KEV catalog, requiring Federal Civilian Executive Branch agencies to patch by September 18, 2026. This is the sixth actively exploited Chrome zero-day patched in 2026.

The Hacker NewsSep 4, 07:18 UTC · 12d agoExploit / PoC in the wildCVE-2026-85046 CVE-2026-2441 CVE-2026-3909+3 CVEs1

Two critical Chrome flaws put users at risk on malicious websites

Google patched 26 Chrome flaws, including two critical use-after-frees and an actively exploited V8 sandbox escape (CVE-2026-85046); update to 152.0.7977.82/.83.

Chrome's desktop update fixes 26 security issues, including critical use-after-free flaws CVE-2026-84353 in Shared Tab Groups and CVE-2026-84352 in WebGL, both allowing code execution outside the browser sandbox via crafted HTML pages. Google subsequently patched CVE-2026-85046, a high-severity V8 JavaScript engine flaw with exploits already in the wild that enables arbitrary code execution inside the Chrome sandbox; HKCERT rates the overall risk as extremely high. Fixed versions are 152.0.7977.82/.83 on Windows and Mac and 152.0.7977.82 on Linux.

Malwarebytes LabsSep 2, 11:15 UTC · 14d agoExploit / PoC in the wildCVE-2026-84352 CVE-2026-84353 CVE-2026-850461

An untrusted site can freeze a Mac using WebGPU

A security researcher shows an untrusted website can trigger a system-wide freeze of a Mac via the WebGPU API.

A blog post describes how an untrusted website can use the WebGPU API to cause a Mac to freeze, taking down the whole system rather than just the browser tab. The write-up appears to analyze the underlying GPU/browser behavior that leads to the hang. The source text provided is minimal, so technical specifics such as affected browsers, macOS versions, and disclosure status are not stated.

Lobsters · securitySep 11, 00:04 UTC · 5d agoResearch

CISA Warns of Chromium Type Confusion 0-Day Vulnerability Actively Exploited in Attacks

CISA added the actively exploited Chromium V8 type confusion zero-day CVE-2026-85046 to its KEV catalog, urging patching of Chrome, Edge, and Opera.

CISA added CVE-2026-85046, a V8 type confusion flaw (CWE-843) in Chromium-based browsers, to its Known Exploited Vulnerabilities catalog. A remote attacker can trigger arbitrary code execution inside the browser sandbox via a specially crafted HTML page. Google Chrome is directly affected, and Microsoft Edge, Opera, and other Chromium-based browsers may also be impacted depending on their V8 version. Google has released a Stable channel Chrome update, and CISA directs mitigations under Binding Operational Directive 26-04.

Cyber Security NewsSep 8, 16:25 UTC · 7d agoExploit / PoC in the wildCVE-2026-85046

Google fixes the seventh actively exploited Chrome zero-day of 2026

Google patched 230 Chrome flaws in version 153.0.8010.36, including actively exploited V8 out-of-bounds write CVE-2026-87491 (CVSS 8.8), the seventh 2026 Chrome zero-day.

Google released Chrome 153.0.8010.36 on Linux and 153.0.8010.36/.37 on Windows and Mac, fixing 230 security vulnerabilities. CVE-2026-87491, an out-of-bounds write in the V8 JavaScript and WebAssembly engine (CVSS 8.8), is being exploited in the wild through specially crafted HTML pages to execute arbitrary code inside Chrome's sandbox. Google says it is the seventh actively exploited Chrome zero-day of 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645, and CVE-2026-85046. Researcher Jihyeon Jeong of Seoul National University reported it on 2026-08-06 and received a $2,500 bounty; Google disclosed no technical details or attribution.

Security AffairsSep 9, 13:47 UTC · 7d agoExploit / PoC in the wildCVE-2026-87491 CVE-2026-2441 CVE-2026-3909+4 CVEs

⚡ Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack and More

Weekly recap: actively exploited Chrome V8 zero-day, MikroTik RouterOS zero-day chain, Magento StyleSmuggler backdoor, and critical N-able N-central flaws.

Google patched an actively exploited Chrome V8 type confusion zero-day, CVE-2026-85046 (CVSS 8.8), the sixth exploited Chrome zero-day of 2026. CERT Polska warned of the MikroTrick exploit chain (CVE-2026-67276 and CVE-2026-86060, CVSS 9.2) giving unauthenticated full control of MikroTik RouterOS devices via SSH, observed since September 2. Sansec disclosed the StyleSmuggler Magento/Adobe Commerce zero-day used since September 4 to inject a Rust backdoor into online stores, while N-able patched three critical N-central flaws (CVE-2026-86206, CVE-2026-86207, and CVE-2026-86218, CVSS 10.0) with Huntress observing likely exploitation. Elastic and Morphisec also detailed RevStealer, an information stealer spread via game cheats and a fake Claude Desktop app.

The Hacker NewsSep 7, 14:36 UTC · 9d agoExploit / PoC in the wildCVE-2026-85046 CVE-2026-86206 CVE-2026-86207+7 CVEs

Chrome, Firefox Updates Patch 115 Vulnerabilities

Google and Mozilla patch 115 vulnerabilities across Chrome 153 and Firefox 156, including three critical Chrome bugs; no exploitation reported.

Google's Chrome 153 (153.0.8010.47/.48 for Windows/macOS) fixes 42 flaws, including three critical: CVE-2026-91726, an out-of-bounds read in WebGL, and use-after-free bugs CVE-2026-91721 and CVE-2026-91749 in Internals and Workers. Mozilla's Firefox 156 resolves 73 vulnerabilities, including 29 high-severity use-after-free and privilege escalation issues, with related fixes in Thunderbird and Firefox ESR branches. Neither vendor reports any of the defects being exploited in the wild.

SecurityWeek10:28 UTC · 4h agoVulnerability CVE-2026-91726 CVE-2026-91721 CVE-2026-91749

Google fixes yet another actively exploited Chrome zero-day (CVE-2026-87491)

Google patched actively exploited Chrome zero-day CVE-2026-87491, a V8 out-of-bounds write enabling sandboxed code execution, in Chrome 153.0.8010.36+.

Google fixed 230 Chrome vulnerabilities including CVE-2026-87491, a Medium-severity out-of-bounds write in the V8 JavaScript and WebAssembly engine that allows remote arbitrary code execution inside the sandbox via a crafted HTML page. Google confirmed an exploit exists in the wild; fixes shipped in Chrome 153.0.8010.36 and .37 for Windows and macOS and 153.0.8010.36 for Linux. The flaw was reported August 6, 2026 by Jihyeon Jeong of Seoul National University's Compsec Lab, earning a $2,500 bounty. It is the seventh actively exploited Chrome zero-day patched in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281, CVE-2026-11645 and CVE-2026-85046.

Help Net SecuritySep 9, 07:53 UTC · 7d agoExploit / PoC in the wildCVE-2026-87491 CVE-2026-2441 CVE-2026-3909+4 CVEs

Mozilla security advisory (AV26-868)

Canada's Cyber Centre reports Mozilla vulnerabilities fixed in Firefox 155 and Firefox ESR 115.40, 140.15, and 153.2.

Canadian Centre for Cyber Security advisory AV26-868, dated September 1, 2026, notes vulnerabilities in Firefox (versions prior to 155) and Firefox ESR (prior to 115.40, 140.15, and 153.2). The bulletin links to Mozilla's security advisories and urges users and administrators to update. No CVE identifiers or exploitation details are provided.

Canadian Centre for Cyber SecuritySep 1, 18:14 UTC · 14d agoAdvisory

Google Chrome 153 Released With 230 Security Fixes and Zero-Day Exploited in the Wild

Google released Chrome 153 with 230 security fixes, patching CVE-2026-87491, a V8 out-of-bounds write zero-day actively exploited in the wild.

Google shipped Chrome 153 (153.0.8010.36/.37) for Windows, macOS, and Linux with 230 security fixes, including CVE-2026-87491, a medium-severity V8 out-of-bounds write being exploited in the wild. The release also fixes five critical vulnerabilities: four in WebGL (two use-after-frees, an out-of-bounds write, a buffer overflow) and one use-after-free in Cast. High-severity V8 use-after-free and type-confusion defects are among the fixes, and Google has restricted technical details until most users are patched. Administrators should verify deployed versions on managed endpoints, as Chrome-derived browsers may follow different patch schedules.

GBHackersSep 9, 06:17 UTC · 7d agoExploit / PoC in the wildCVE-2026-87491 CVE-2026-87464 CVE-2026-87488+19 CVEs1

Google Chrome Zero-day Vulnerability Exploited in the Wild (CVE-2026-85046)

Google patched 12 Chrome flaws including in-the-wild V8 zero-day CVE-2026-85046; CISA added it to the KEV catalog.

Google released Chrome 152.0.7977.82/.83 for Windows and Mac (152.0.7977.82 for Linux) fixing 12 vulnerabilities, including CVE-2026-85046, a type confusion flaw in the V8 JavaScript engine being exploited in the wild. CISA added CVE-2026-85046 to its Known Exploited Vulnerabilities Catalog with a patch deadline of September 18, 2026. This is Chrome's sixth zero-day patched in 2026, following CVE-2026-2441, CVE-2026-3909, CVE-2026-3910, CVE-2026-5281 and CVE-2026-11645. The other 11 fixes include use-after-free, out-of-bounds, race condition and input validation flaws in Skia, WebGL, DevTools, Network, Compositing and other components.

Qualys ThreatPROTECTSep 7, 05:35 UTC · 9d agoExploit / PoC in the wildCVE-2026-85046 CVE-2026-2441 CVE-2026-3909+14 CVEs

PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution

SOCRadar disclosed PEEP, a post-exploitation Chromium extension toolkit that turns Chrome and Edge into host-level backdoors via native messaging and C2 polling.

SOCRadar researchers detailed PEEP, a Chromium-based post-exploitation toolkit masquerading as a 'Smart Bookmarks' extension injected directly into Chrome and Edge profiles by forging Secure Preferences integrity values, bypassing Web Store checks. A native-messaging host binary (nm_host.exe) extends the browser agent to host-level command execution, file management, credential theft, and session hijacking, while the extension polls C2 endpoints at 206.237.30.232 or xfjcc.fun every 30 seconds over plaintext HTTP and exfiltrates browsing history, cookies, and tab metadata. PEEP is derived from the open-source RedExt red teaming framework, adds PowerShell persistence scripts, and includes a Linux-targeting Python script, suggesting cross-platform intent. The activity is unattributed but contains Chinese-language artifacts; a C2 /health endpoint showed 34 agent entries and 10 active sessions.

The Hacker NewsSep 7, 18:12 UTC · 8d agoMalware in the wild

PEEP: A Browser RAT Posing as a Chrome Extension

SOCRadar's STRU analyzed PEEP, an emerging Chromium-based RAT disguised as a Chrome extension enabling post-exploitation control of browsers.

SOCRadar's Threat Research Unit (STRU) identified and analyzed PEEP, a Chromium-based post-exploitation toolkit distributed as a browser extension. PEEP provides RAT-style capabilities while posing as a legitimate Chrome extension. It is assessed as an emerging threat worth monitoring by defenders.

SOCRadarSep 4, 09:50 UTC · 12d agoMalware

ZDI-26-610: Apple Safari JavaScriptCore B3 ReduceStrength Phase Use-After-Free Remote Code Execution Vulnerability

ZDI details a use-after-free in Apple Safari's JavaScriptCore (CVE-2026-64715) that allows remote code execution after a user visits a malicious page.

The Zero Day Initiative published advisory ZDI-26-610 for a use-after-free in the B3 ReduceStrength phase of Apple Safari's JavaScriptCore. Successful exploitation allows remote attackers to execute arbitrary code, but user interaction is required, such as visiting a malicious page or opening a malicious file. ZDI rates the vulnerability 8.8 on CVSS and assigned CVE-2026-64715. The advisory does not report exploitation in the wild.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoVulnerability CVE-2026-64715

Chrome adopts what may be the best protection yet against account takeovers

Chrome adopts device-bound session credentials that tie login sessions to a specific device, defending against cookie-theft account takeover attacks.

Chrome is adopting device-bound session credentials, which bind authenticated sessions to the physical device rather than to transferable cookies. The mechanism targets a common account takeover technique in which attackers steal session cookies and replay them on other machines. Ars Technica characterizes it as possibly the strongest protection yet against this class of takeover, which has become increasingly common.

Ars Technica · SecurityAug 11, 20:59 UTC · Aug 11, 2026Tools

12 Best Enterprise Browsers Compared (2026): Features & Pricing

2026 comparison of twelve enterprise browsers ranks Island and Palo Alto Talon as purpose-built leaders, with Chrome Enterprise and Edge free or bundled.

Guide compares twelve enterprise browser options across three models: purpose-built secure browsers (Island, Talon, Surf), layered controls on existing browsers (Chrome Enterprise, Edge for Business, LayerX, Seraphic), and streamed/isolated browsers (Kasm). Island and Palo Alto's Prisma Access Browser lead the purpose-built category for BYOD and contractor DLP. It also notes Mammoth Cyber has ceased operations.

GBHackersSep 15, 06:32 UTC · 1d agoTools

ZDI-26-590: libwebsockets HTTP/2 HPACK Path Header Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability

ZDI disclosed CVE-2026-19773, an unauthenticated out-of-bounds write allowing remote code execution in libwebsockets HTTP/2 HPACK parsing, rated CVSS 9.8.

The Zero Day Initiative published advisory ZDI-26-590 for an out-of-bounds write vulnerability in libwebsockets' HTTP/2 HPACK path header parsing. A remote attacker can execute arbitrary code on affected installations without authentication. The flaw is tracked as CVE-2026-19773 and carries a CVSS score of 9.8.

ZDI Published AdvisoriesAug 24, 05:00 UTC · 23d agoVulnerability CVE-2026-19773