#Browser Security
All CosmicBytez Labs articles tagged #Browser Security, across news, security advisories, how-to guides, and projects.
- News
The EDR Blind Spot: 3 Ways Browser Attacks Evade Endpoint Telemetry
AiTM phishing, malicious extensions, and clipboard-hijack attacks finish inside the browser, leaving little for endpoint detection tools to catch.
- News
Know Your Enemy: Browser-Based Attack Techniques in 2026
Six browser-native attack techniques — from AiTM phishing kits to malicious extensions — now carry the entire intrusion chain inside a single browser tab.
- News
BragJack attacks hijack AI browser agents through malicious extensions
A single malicious browser extension used 'Prompt Forcing' to hijack AI agents in Chrome, Edge, Opera Neon, Comet, and Claude in Chrome, earning two CVEs.
- News
Google Chrome May Soon Block New Tab Hijacker Extensions by Default
Google is preparing a new Chrome security feature that would prevent policy-installed extensions from overriding the New Tab page or changing the default...
- News
Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable
A sophisticated malvertising campaign dubbed SourTrade has been delivering malware by sending fragmented chunks to victims' browsers, which then assemble...
- News
SourTrade: Malicious Sites Use JavaScript to Assemble Malware Directly in Browser Memory
The SourTrade malvertising campaign impersonates Solana, Luno, and TradingView to deliver malware assembled entirely inside browser memory using...
- Security
CVE-2026-15773: Chrome Use-After-Free Sandbox Escape (CVSS 9.6)
A critical use-after-free vulnerability in Google Chrome's Core component on Windows allows remote attackers to escape the browser sandbox via a crafted...
- Security
CVE-2026-58281: Microsoft Edge RCE via Deserialization of Untrusted Data
A high-severity deserialization vulnerability in Microsoft Edge (Chromium-based) allows unauthorized network attackers to execute arbitrary code. CVSS 8.3...
- News
AI-Generated Browser Ransomware Abuses Chromium API on Windows, Linux, macOS, Android
Researchers have uncovered a novel malware artifact generated using DeepSeek that weaponizes the Chromium File System Access API to encrypt files entirely...
- News
Fake Perplexity Extension on Chrome Web Store Tracked Searches and Harvested Browsing Data
A malicious extension masquerading as the Perplexity AI answer engine was discovered on the Chrome Web Store, intercepting search traffic and collecting...
- News
Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability
Security researchers at Island discovered that 'Adblock for YouTube,' a Chrome extension with over 10 million installs and a Featured badge, contains a...
- News
Malicious Edge Extension "Edgecution" Abuses Native Messaging to Deploy Ransomware Backdoor
Zscaler researchers exposed 'Edgecution', a rogue Microsoft Edge extension that exploits Chrome's Native Messaging protocol to escape the browser sandbox...
- News
Edgecution: Malicious Edge Extension Escapes Browser Sandbox via Native Messaging
A malicious Microsoft Edge extension dubbed 'Edgecution' abused the Native Messaging API to escape the browser sandbox and deliver a Python backdoor used...
- News
Chrome and Firefox Updated to Patch Critical, High-Severity Vulnerabilities
Both Google and Mozilla have released urgent browser updates addressing multiple memory safety vulnerabilities, including critical-severity flaws that...
- News
What the 2026 DBIR Confirms: Attacks Are Living in the Browser
The 2026 Verizon DBIR confirms phishing, shadow AI, malicious extensions, and credential theft now execute inside the browser, exposing major security gaps.
- News
Hola Browser for Windows Compromised to Deliver Cryptominer
The Windows version of the Hola Browser has been hit by a supply chain attack that bundled a cryptocurrency miner with the official installer, silently…
- News
Chrome 148 Update Patches 151 Vulnerabilities Including Critical RCE Flaws
Google has released Chrome 148 with patches for 151 security vulnerabilities, including critical-severity flaws that could allow remote code execution....
- News
Microsoft Backpedals: Edge to Stop Loading Cleartext
Microsoft is reversing course on a controversial Edge browser behavior that loaded all saved passwords into process memory in cleartext at startup — a...
- News
Google Fixes Fourth Chrome Zero-Day Exploited in Attacks in 2026
Google has patched the fourth Chrome zero-day vulnerability actively exploited in attacks this year, a use-after-free flaw in the Dawn graphics engine...
- News
New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation
Google has released a Chrome security update patching 21 vulnerabilities including a high-severity use-after-free zero-day in the Dawn graphics engine...
- Security
Google Patches First Chrome Zero-Day of 2026: CVE-2026-2441
Google has patched CVE-2026-2441, a high-severity use-after-free vulnerability in Chrome's CSS component that has been actively exploited — the first...
- News
Malicious Chrome Extension 'CL Suite' Steals Meta Business
Security researchers have uncovered a malicious Chrome extension called CL Suite that steals TOTP 2FA seeds, Meta Business Manager data, and analytics,...
- News
Google Chrome Critical Update Patches High-Severity Code
Google releases emergency security update for Chrome addressing two high-severity vulnerabilities that could allow arbitrary code execution and system crashes.
- News
Google Patches Actively Exploited Chrome Zero-Day
Google has released an emergency Chrome update to fix a zero-day vulnerability being actively exploited in targeted attacks against journalists and activists.