CISA adds Chromium XML use-after-free CVE-2026-125350 to KEV
A crafted webpage can run code inside the Chromium sandbox; federal mitigation deadline is November 24.
Stories per day · 30 days
Relatedscareware2smart-screen2certificates1chrome1chromium1cisa1code-signing1emudhra1kev1microsoft1notifications1scams1tls1use-after-free1windows1
17 stories, newest first · one card per story
Stories tagged #edge
Microsoft Edge Blocks Malicious Websites Sending Fake Virus Alert Notifications
Edge 156 automatically disables notifications from scam sites detected by SmartScreen and Scareware.
Microsoft Edge Automatically Blocks Malicious Browser Notifications
Edge 156 now links Scareware blocker and SmartScreen detections to notification permissions, automatically disabling them for scam sites.
Microsoft revokes trust in compromised eMudhra certificates
An October 26 Windows update drops seven certificates after weak key generation exposed eight eMudhra intermediate keys.
HPQ-AKE: A Provably Secure Sign-Less Hybrid Authenticated Key Exchange Protocol for Bandwidth-Constrained IoT and Edge Networks
HPQ-AKE replaces transcript signatures with dual KEMs, cutting modeled IoT handshake size 56.4% versus hybrid TLS 1.3.
100 days later: Microsoft still steers Windows and Copilot users to Edge
Mozilla says Microsoft still steers non-EEA Windows and Copilot users toward Edge, 100 days after its report.
Multimodal open d1 decision models for the edge
LiquidAI announces multimodal open D1 decision models built for edge devices.
Stepped MoE: Segment-Level Routing with Configurable Inference Complexity
Stepped MoE combines elastic subnetworks with sparse routing so one model spans 1-4 billion parameters.
Malicious Linux Implants Mimic Asian Mail Security Products
Three new Linux backdoors are disguised as legitimate Asian mail-security and edge products.
NCSC Urges UK organizations to Patch for Citrix NetScaler ADC and Gateway 0-Day Vulnerabilities
The UK NCSC urged immediate patching after two critical Citrix NetScaler zero-days were exploited for unauthenticated remote code execution.
KREMLIN Banking Malware Bypasses Chrome Security to Steal Banking Sessions
Elastic Security Labs details KREMLIN, a Brazilian banking malware that implants malicious Chrome and Edge extensions by forging Chromium integrity values to steal banking sessions.
1
4 groups caught using the same Chrome and Windows exploit kit
Proofpoint says at least four groups, some China-linked, actively share the BlueMoon kit chaining two Chromium and one Windows kernel exploit.
Patch Tuesday - September 2026
Microsoft's September 2026 Patch Tuesday fixes 999 CVEs, a record, with two zero-day privilege escalation flaws already exploited in the wild.
Microsoft patches a record 972 vulnerabilities, 112 of them critical
Microsoft's September Patch Tuesday fixes a record 972 vulnerabilities, 112 rated critical, including two zero-days in Windows components.
PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution
SOCRadar disclosed PEEP, a post-exploitation Chromium extension toolkit that turns Chrome and Edge into host-level backdoors via native messaging and C2 polling.
5
Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers
SpecterOps released CDP-Enable-BOF, a Beacon Object File that enables Chrome DevTools Protocol in live Chrome or Edge processes on Windows for session hijacking.
[local] Microsoft Edge 150.0.4078.48 - RCE
Exploit-DB publishes a local remote code execution exploit for Microsoft Edge 150.0.4078.48.