#Chrome
All CosmicBytez Labs articles tagged #Chrome, across news, security advisories, how-to guides, and projects.
- News
Chinese Hackers Exploit Chrome-Windows Zero-Day Chain to Deploy CLEANGULP Malware
China-linked UTA0565 chained Chrome and Windows zero-days via spoofed websites to deploy the new CLEANGULP backdoor against Asian targets.
- News
BragJack attacks hijack AI browser agents through malicious extensions
A single malicious browser extension used 'Prompt Forcing' to hijack AI agents in Chrome, Edge, Opera Neon, Comet, and Claude in Chrome, earning two CVEs.
- News
WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension Storage
A stripped-down JS stealer hidden in 13 npm packages harvests Chrome extension storage, echoing North Korea-linked BeaverTail and OtterCookie.
- News
KREMLIN Malware Force-Installs Malicious Chrome and Edge Extensions
Elastic found KREMLIN, a banking malware toolkit that forges Chrome/Edge integrity checks to sideload data-stealing extensions without user consent.
- News
China-Linked Hackers Chain Chrome and Windows Zero-Days to Deploy GRIMWEDGE
UTA0560 chained 3 Chrome and Windows zero-days in a phishing campaign against NGOs, deploying the GRIMWEDGE backdoor via a hijacked university site.
- News
Twitch Extension With 30K Installs Exposes Users' OAuth Tokens
Twitch Enhanced Viewer | JeetBot, installed 30,000+ times, quietly forwarded users' OAuth tokens to a Russian commercial bot service, Socket found.
- News
New 'BlueMoon' Exploit Kit Chains Chrome and Windows Zero-Days for Espionage
At least four espionage-linked threat clusters adopted the BlueMoon exploit kit within days, chaining Chrome and Windows zero-days for backdoor access.
- News
Weekly Recap: Chrome 0-Day, Router Hijacks, Coder Supply Chain Attack, and More
This week's roundup: a sixth Chrome zero-day, mass MikroTik router hijacking, a Coder registry compromise, and N-able's third N-central RCE.
- News
737 Chrome VPN Extensions Caught Routing Traffic Through Attacker Proxies
Socket researchers found 737 fake Chrome VPN extensions silently routing 75,000+ users through SOCKS5 proxies on port 1082, enabling full AiTM interception.
- News
Google Chrome Cuts 7 Billion Unwanted Android Notifications Per Day
Google's Chrome anti-abuse systems blocked more than 7 billion unwanted notifications on Android per day during Q1 2026, using AI-powered detection to...
- News
Google Chrome May Soon Block New Tab Hijacker Extensions by Default
Google is preparing a new Chrome security feature that would prevent policy-installed extensions from overriding the New Tab page or changing the default...
- News
Chaos Ransomware Uses msaRAT to Route C2 Traffic Through Headless Chrome and Edge
Cisco Talos has detailed msaRAT, a Rust-based implant used by the Chaos ransomware group that hides its command-and-control channel inside the victim's...
- News
Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data
Researchers at Guardio disclosed a now-patched vulnerability chain in the Adobe Acrobat Chrome extension dubbed HermeticReader, which could allow...
- News
msaRAT: Chaos Ransomware's New Backdoor Hides C2 Traffic Inside Chrome and Edge
Cisco Talos has uncovered msaRAT, a Rust-based remote access trojan deployed by the Chaos ransomware group that routes all command-and-control traffic...
- News
ThreatsDay: Game Cheat Spyware, Spirals Ransomware, Chrome Sync Stalking
This week's threat roundup covers NuGet packages poisoned with game-cheat spyware, the Spirals ransomware deploying network-wide in under 24 hours, and...
- News
North Korean Hackers Publish 108 Malicious Packages in PolinRider Campaign
Threat actors linked to North Korea's Contagious Interview campaign have published 108 malicious packages and browser extensions across npm, Packagist,...
- News
Google Loses Final Appeal to Overturn €4.1 Billion EU Antitrust Fine
The Court of Justice of the European Union has dismissed Google's final appeal against a €4.1 billion antitrust fine, confirming that the company...
- News
Malicious Perplexity Chrome Extension Intercepted Searches and Address Bar Input
Microsoft uncovered a fake Perplexity AI Chrome extension that silently captured every search query and address bar keystroke, routing the data to an...
- News
Chrome Ad Blocker with 10M+ Installs Found with Dormant Script Injection Capability
Security researchers at Island discovered that 'Adblock for YouTube,' a Chrome extension with over 10 million installs and a Featured badge, contains a...
- News
Chrome and Firefox Updated to Patch Critical, High-Severity Vulnerabilities
Both Google and Mozilla have released urgent browser updates addressing multiple memory safety vulnerabilities, including critical-severity flaws that...
- News
Weekly Recap: Chrome 0-Day, UniFi Exploits, macOS Stealers, VPN Flaw and More
This week's security roundup covers an actively exploited Chrome zero-day, attackers abusing UniFi network controllers, fresh macOS infostealer campaigns,...
- Security
CVE-2026-11645: Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
A critical out-of-bounds read and write vulnerability in the Chromium V8 engine allows remote attackers to execute arbitrary code inside a sandbox via a...
- News
AI Agent Uncovers 21 Zero-Days in FFmpeg; Chrome Patches Record 429 Bugs
An autonomous AI security agent found 21 previously unknown vulnerabilities in FFmpeg, the media library powering countless applications. The same week…
- News
Chrome 148 Update Patches 151 Vulnerabilities Including Critical RCE Flaws
Google has released Chrome 148 with patches for 151 security vulnerabilities, including critical-severity flaws that could allow remote code execution....
- News
Google Accidentally Exposed Details of Unfixed Chromium Flaw
Google accidentally leaked information about an unpatched Chromium vulnerability that allows JavaScript to continue running in the background even after...
- Security
Google Chrome GPU Use-After-Free Sandbox Escape
A CVSS 9.6 critical use-after-free vulnerability in the GPU component of Google Chrome prior to 147.0.7727.138 allows a remote attacker to potentially...
- News
Patch Tuesday, April 2026 Edition
Microsoft released patches for 167 security vulnerabilities in April 2026, including an actively exploited SharePoint Server zero-day and the publicly...
- News
In Other News: Satellite Cybersecurity Act, $90K Chrome
This week's cybersecurity roundup covers the proposed Satellite Cybersecurity Act, a $90,000 Chrome heap overflow bug, a 16-year-old hacker arrest,...
- News
Weekly Recap: Axios Hack, Chrome 0-Day, Fortinet Exploits
This week's biggest cybersecurity stories: a North Korean supply chain attack hit the Axios npm package, a new Chrome zero-day under active exploitation,...
- News
The Good, the Bad and the Ugly in Cybersecurity – Week 14
SentinelOne intercepts a LiteLLM supply chain attack in real time, attackers weaponize the Axios npm package to deploy a cross-platform RAT, and a Chrome...
- News
Google Fixes Fourth Chrome Zero-Day Exploited in Attacks in 2026
Google has patched the fourth Chrome zero-day vulnerability actively exploited in attacks this year, a use-after-free flaw in the Dawn graphics engine...
- News
New Chrome Zero-Day CVE-2026-5281 Under Active Exploitation
Google has released a Chrome security update patching 21 vulnerabilities including a high-severity use-after-free zero-day in the Dawn graphics engine...
- Security
CVE-2026-5272: Chrome GPU Heap Buffer Overflow Enables
A high-severity heap buffer overflow in Chrome's GPU component allows remote attackers to execute arbitrary code via a crafted HTML page. Affects all...
- News
VoidStealer Malware Steals Chrome Master Key via Debugger
A new infostealer named VoidStealer bypasses Chrome's Application-Bound Encryption by attaching a remote debugger to the browser process and using the...
- News
Google Begins Post-Quantum Cryptography Rollout Across
Google activates ML-KEM post-quantum key encapsulation by default in Chrome 134 and announces migration timeline for all Google Cloud TLS connections.