CISA adds Chromium XML use-after-free CVE-2026-125350 to KEV
A crafted webpage can run code inside the Chromium sandbox; federal mitigation deadline is November 24.
Stories per day · 30 days
3 RSS
Relatedchrome3google3use-after-free3cisa2kev2android1barracuda1browser1cisco1claude1edge1embeddable-library1logic-bugs1memory-corruption1microsoft-edge1open-source1outlook1patch1
35 stories, newest first · one card per story
Stories tagged #chromium
CISA adds six exploited vulnerabilities to its KEV catalog
Entries cover Cisco BroadWorks, Barracuda products, Outlook, and Chromium; FCEB agencies must prioritize them under BOD 26-04.
Zebkit enables embedding Chromium as a library
Zebkit is a project that allows Chromium to be used as an embeddable library.
Google fixes 52 Chrome flaws, including four critical bugs
Stable builds move to 156.0.8078.73/.74 on Windows and Mac and 156.0.8078.73 on Linux, with no exploitation stated.
Orange Tsai details logic-only Microsoft Edge full chain from Pwn2Own
DEVCORE used five logic bugs and two Windows features for an Edge sandbox escape, earning $175,000 and a Pwnie award.
2
Google Chrome 155 Patches Critical Use-After-Free Flaw and Nine Additional Security Bugs
Google patched ten Chrome 155 flaws, including critical Prerender use-after-free CVE-2026-110922, with no known exploitation.
Researchers Discover New Domain Spoofing Techniques That Bypass Chrome’s Phishing Protections
Researchers showed IDN lookalike domains can evade Chrome’s Unicode display and near-match phishing warnings.
New Unicode Characters Let Attackers Create Convincing Lookalike Domains for Phishing
Researchers showed Chromium can display Unicode brand lookalike domains as readable text, bypassing Punycode warnings.
Two characters open up a world of typosquatting opportunities in Chromium browsers
Researchers demonstrate Cyrillic barred-o and Latin k-hook glyphs bypass Chromium's anti-spoofing checks, letting lookalike domains like fake Apple and Okta render as genuine.
4
CastleStealer Malware Uses Browser Protection Bypass and Remote Shell to Expand Attacker Access
CastleStealer now bypasses Chromium App-Bound Encryption and adds a remote shell on Windows.
3
CastleStealer Malware Bypasses Chromium ABE and Adds Remote Command Execution Capabilities
CastleStealer now bypasses Chromium app-bound encryption, runs remote commands, and exfiltrates data over encrypted TCP.
3
Warden Stealer Malware Targets Claude, Codex, Grok and Cursor to Steal AI Agent Data
Warden Stealer, a Rust malware-as-a-service, harvests tokens and prompts from Claude, Codex, Grok, and Cursor.
8
Chromium Hardening Guide
A Chromium hardening guide covers browser choice, enterprise policies, flag persistence, and safer content-blocking options.
4
BragJack attacks hijack AI browser agents through malicious extensions
Forever Security's Gal Weizman disclosed BragJack, a malicious-extension technique hijacking AI browser agents from Chrome Gemini to Claude, earning $20,000 in bounties.
BragJack Attack Lets Malicious Extensions Hijack AI Agents Across 5 Major Browsers
Researchers demonstrated 'BragJack' browser-extension attacks that hijack AI agents in Chrome, Edge, Comet, Opera Neon, and Claude, leading to two CVEs and vendor patches.
8
Google Chrome 153 Update Fixes 16 Security Flaws, Including Two Critical Vulnerabilities
Google released Chrome 153 fixing 16 vulnerabilities, including critical use-after-free in Dawn/WebGPU and a WebGL buffer overflow, across Windows, macOS, and Linux.
Malware bypasses browser checks to force install Chrome, Edge extensions
Elastic Security Labs detailed KREMLIN, a Brazilian banking malware that silently installs malicious Chrome and Edge extensions, with 1,515 confirmed infections.
3
KREMLIN Banking Malware Bypasses Chrome Security to Steal Banking Sessions
Elastic Security Labs details KREMLIN, a Brazilian banking malware that implants malicious Chrome and Edge extensions by forging Chromium integrity values to steal banking sessions.
1
The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions
Elastic details KREMLIN, a Brazilian banking malware whose malicious Chrome/Edge extension forges Chromium integrity checks to steal sessions.
2
Attackers are weaponizing the gap between Chromium fixes and Chrome patches
Espionage actors use the BlueMoon exploit kit to chain Chrome V8 and Windows kernel zero-days via spear phishing, gaining full admin on unpatched endpoints.
CVE-2026-87464: RCE outside sandbox in Chromium prior to 153.0.8010.36
CVE-2026-87464 is a critical use-after-free in Chrome's WebGL allowing sandbox-escaping RCE via crafted HTML pages, fixed in 153.0.8010.36.
Chinese espionage groups swarm to exploit triple-link chain of zero-days
At least four China-aligned espionage groups chained three zero-days in Chromium browsers and Windows ALPC for espionage since late August.
4 groups caught using the same Chrome and Windows exploit kit
Proofpoint says at least four groups, some China-linked, actively share the BlueMoon kit chaining two Chromium and one Windows kernel exploit.
Multiple Chinese hacking groups seen using identical Chrome zero-day exploit
Four China-linked espionage groups share identical BlueMoon Chrome zero-day exploit kit targeting US defense contractors and Asian government agencies.