Session hijacking news · zeroday.news

session hijacking

3 stories

css attacksAug 9, 2026high

Webmail CSS Attacks Expose a New Risk for AI-Powered Email Tools

Researchers have discovered that CSS, typically used for styling web pages, can be weaponized in webmail clients to steal user credentials, hijack sessions, and manipulate AI tools. These attacks exploit vulnerabilities in how email clients handle HTML and CSS, allowing malicious styling to interact with the trusted interface. The research highlights risks for major services like Outlook, Gmail, and Yahoo Mail, particularly concerning AI integrations.

CVE-2026-8233Jul 31, 2026high

Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw

Researchers have identified a significant class of 84 previously unknown vulnerabilities, dubbed 'iTrue' flaws, affecting the core networks of 4G and 5G mobile systems. These vulnerabilities stem from implicit trust errors between network functions, exacerbated by the shift to cloud-native deployments. Exploitation could lead to denial-of-service attacks and session hijacking, where an attacker seizes control of a user's network session.

vulnerabilityJul 7, 2026critical

Writer AI Flaw Could Let Agent Previews Leak Session Tokens Across Tenants

A now-patched critical session isolation flaw was found in the enterprise generative-AI platform Writer. It could have let agent previews leak session tokens, enabling cross-tenant compromise.

Loading