Search: “Chromium”

32 stories

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 247 Malware 177 Exploit / PoC 162 Threat actor 36 Ransomware 30 Data breach 22 Phishing & fraud 22 Industry 18 Policy & legal 11 Tools 6 Research 5 AI tools & infra 4 AI safety & security 4 Advisory 3

SeverityAll critical 359 high 169 medium 170 low 35 info 17

China-Linked Hackers Exploit Sogou One-Click RCE to Deploy GRAYRABBIT Backdoor

China-linked UNC3569 exploited CVE-2026-51990 in Sogou Input Method to deploy the GRAYRABBIT backdoor in active espionage intrusions.

Gen Threat Labs discovered UNC3569 exploiting CVE-2026-51990, a one-click RCE in Tencent's Sogou Input Method for Windows that chains an insecure sgbiz: protocol handler with an unsandboxed Chromium 80 CEF webview. The chain weaponizes CVE-2021-38003 (V8 type confusion) to run shellcode that DLL-sideloads via 7z.exe/7z.dll and deploys the GRAYRABBIT backdoor, which beacons over RC4-encrypted raw TCP 443 to mail.uaiubifas[.]top. Tencent patched the issue in version 16.3.0.3498, released via automatic updates on April 21, 2026. UNC3569 is a PRC-nexus espionage actor targeting government, education, technology, and financial sectors across East and Southeast Asia.

GBHackersupdated Sep 14, 13:01 UTC · 1d agofirst Sep 14, 08:09 UTC · 1d agoThreat actor in the wild 3 sources CVE-2026-51990 CVE-2021-380031

One Exploit Chain, Two Espionage Campaigns: Chrome and Windows Under Fire

Two China-linked APT groups reused identical Chrome/Windows zero-day chain against NGOs, deploying GRIMWIDGE backdoor and LONGTALE credential-stealing extension.

Volexity reports that China-linked actors UTA0560 and JungleBamboo (APT31/TA412) ran byte-identical Chrome/Windows exploit chains against NGOs starting September 1, 2026, combining Chrome type confusion CVE-2026-85046, WebAssembly sandbox escape CVE-2026-87491, and Windows kernel flaw CVE-2026-85880. The Chrome bug was fixed in Chromium source but not yet shipped to Chrome users, making it an effective zero-day with an unusual patch gap. UTA0560 delivered the in-memory GRIMWEDGE JScript backdoor, while JungleBamboo deployed the SUPERSTOMP loader installing LONGTALE, a malicious Chrome extension disguised as Google Gemini that steals cookies, session tokens, and keystrokes. Volexity assesses with low confidence the exploit chain was sold or shared among different Chinese end-users.

Security Affairs10:17 UTC · 12h agoThreat actor in the wild 20 sources CVE-2026-85046 CVE-2026-87491 CVE-2026-85880

Search: “Chromium”

China-Linked Hackers Exploit Sogou One-Click RCE to Deploy GRAYRABBIT Backdoor

One Exploit Chain, Two Espionage Campaigns: Chrome and Windows Under Fire

Recent Satacom campaign delivers cryptocurrency

Meta and Yandex are de-anonymizing Android users’ web browsing identifiers

Friday Squid Blogging: Hundred-Million-Year-Old Squid Relative Found in Amber

How the ToddyCat APT group gains access to Gmail accounts

From clinics to government: UAC-0247 expands cyber campaign across Ukraine

Profiling the Linken Sphere Anti

Malvertising campaign leads to PS1Bot, a multi

North Korean APT group ‘Kimsuky’ targeting experts with new spearphishing campaign

Masslogger campaigns exfiltrates user credentials

Malicious Chrome Extensions Downloaded Over 33 Million Times

MuddyWater Uses DLL Side-Loading in Espionage Campaign Targeting 9 Countries

North Korea-linked threat actors abuse VS Code auto

New Cloud Atlas APT campaign

Iran-linked hackers target Israeli, Egyptian critical infrastructure through phishing campaign

MuddyWater Uses Compromised Mailboxes in Global Phishing Campaign

Lazarus Group Deploys Marstech1 JavaScript Implant in Targeted Developer Attacks

Lazarus targets nuclear

Data privacy watchdog files complaint against Mozilla for new ad tracking feature

Threat Actors Shift to JavaScript

The End of an Era: Microsoft Phases Out VBScript for JavaScript and PowerShell

How are state-sponsored threat actors leveraging AI?

German and South Korean Agencies Warn of Kimsuky's Expanding Cyber Attack Tactics

Talos uncovers espionage campaigns targeting CIS countries, embassies and EU health care agency

Chinese Cyber Espionage Hackers Using USB Devices to Target Entities in Philippines

A threat actor exploited 11 zero

How hackers used malicious Chrome extensions in a mass spying campaign

APT or not APT? What’s Behind the Aggah Campaign

New Wine in Old Bottle: New Azorult Variant Found in FindMyName Campaign using Fallout Exploit Kit

DNSpionage Campaign Targets Middle East

Adware Campaign borrows Obfuscation Techniques from Operation Aurora