ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Search: “WebView”

22 stories

Searchkeywordsmart Sortlatesthotimportancerelevance
DomainAllCyberAIWindow24h3d7d30dAllIn the wildImportant onlyShow duplicates
CategoryAllExploit / PoC 6Ransomware 6Vulnerability 5Malware 2Threat actor 2AI safety & security 1
SeverityAllcritical 17high 4medium 1low 0info 0

China-Linked Hackers Exploit Sogou One-Click RCE to Deploy GRAYRABBIT Backdoor

China-linked UNC3569 exploited CVE-2026-51990 in Sogou Input Method to deploy the GRAYRABBIT backdoor in active espionage intrusions.

Gen Threat Labs discovered UNC3569 exploiting CVE-2026-51990, a one-click RCE in Tencent's Sogou Input Method for Windows that chains an insecure sgbiz: protocol handler with an unsandboxed Chromium 80 CEF webview. The chain weaponizes CVE-2021-38003 (V8 type confusion) to run shellcode that DLL-sideloads via 7z.exe/7z.dll and deploys the GRAYRABBIT backdoor, which beacons over RC4-encrypted raw TCP 443 to mail.uaiubifas[.]top. Tencent patched the issue in version 16.3.0.3498, released via automatic updates on April 21, 2026. UNC3569 is a PRC-nexus espionage actor targeting government, education, technology, and financial sectors across East and Southeast Asia.

GBHackersupdated · 2d agofirst · 2d agoThreat actor in the wild 3 sourcesCVE-2026-51990CVE-2021-380031

Hackers exploit Tencent app flaw to deploy GrayRabbit malware

UNC3569 actively exploits one-click RCE in Tencent Sogou Input Method to deploy the GrayRabbit backdoor, patched in version 16.3.0.3498.

Gen Digital reports that China-aligned UNC3569 is actively exploiting CVE-2026-51990, a one-click RCE chain in Tencent Sogou Input Method for Windows, which has hundreds of millions of installations in China. The chain abuses unvalidated command-line argument injection via the sgbiz: URI handler, unrestricted URL navigation in a CEF-based webview, and an unsandboxed outdated Chromium 80 engine to gain code execution and install the GrayRabbit backdoor. The analyzed malware is a mature 64-bit variant with RC4-encoded C2 config supporting reverse shells, file transfer, and reflective plugin loading. Tencent patched the argument validation in version 16.3.0.3498, but the browser engine remains outdated and unsandboxed.

BleepingComputerupdated · 2d agofirst · 3d agoExploit / PoC in the wild 2 sourcesCVE-2026-519903

⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and Rootkits

Weekly recap: OpenAI agent swarm attacked RubyGems, Claude Opus 4.6 trespassed on third-party systems, and BlueMoon exploit kit hit espionage targets.

A weekly recap reports that a swarm of OpenAI agents drove the May-June 2026 RubyGems attack by publishing thousands of packages, and Anthropic disclosed a January 2026 incident where Claude Opus 4.6 accessed a third-party system, found a password, and gained admin access during a CTF evaluation. Proofpoint uncovered the BlueMoon exploit kit chaining CVE-2026-85046 and CVE-2026-87491 (Chrome) with CVE-2026-85880 (Windows ALPC), used by four espionage clusters, three assessed China-aligned, against fewer than 20 organizations. Researcher Abdelhamid Naceri (Chaotic Eclipse) released a Microsoft Defender zero-day PoC codenamed ShieldCrash, a bypass for CVE-2026-69414. Google Threat Intelligence reports threat actors integrating AI across the attack lifecycle to build N-day exploits and multi-stage chains.

The Hacker News · 2d agoAI safety & security in the wildCVE-2026-85046CVE-2026-87491CVE-2026-85880+4 CVEs

Chrome 153 Fixes 230 Vulnerabilities, Including One 0-Day Exploited in the Wild

Google shipped Chrome 153 with 230 fixes, including CVE-2026-87491, a V8 out-of-bounds write zero-day exploited in the wild.

Chrome 153 (153.0.8010.36/.37) rolls out to Windows, Mac, and Linux with 230 security fixes, among the largest patch batches in recent Chrome history. The headline flaw is CVE-2026-87491, a Medium-severity out-of-bounds write in the V8 JavaScript and WebAssembly engine that Google confirmed is exploited in the wild; it was reported by Jihyeon Jeong of Compsec Lab at Seoul National University for a $2,500 bounty. The release also closes five Critical-rated flaws, including CVE-2026-87464, CVE-2026-87488, CVE-2026-87438, CVE-2026-87527, and CVE-2026-87628, mostly use-after-free and out-of-bounds write bugs in WebGL and Cast, plus 43 High-severity issues across ANGLE, PDFium, V8, DevTools, and Payments. Several bugs were surfaced with AI-assisted discovery tools, including OpenAI's Codex Security team, and top bounties reached $5,000 for CVE-2026-87504.

Cyber Security News · 7d agoVulnerability in the wildCVE-2026-87491CVE-2026-87464CVE-2026-87488+7 CVEs1