1 CVEs published in the last four months and 8 stories. Exploited flaws first.
| CVE | CVSS | Severity | Product | Summary | Published |
|---|---|---|---|---|---|
| CVE-2017-20279 | 8.2 | high | joomla payage | Joomla Payage 2.05 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate dat | 115d ago |
A new attack technique, dubbed "BragJack" by its discoverer, security researcher Gal Weizman of Forever Security, can hijack AI assistants embedded in popular browsers using a single malicious browser extension. The proof-of-concept demonstrated the technique against five Chromium-based browsers or browser assistants: Google Chrome's Gemini Live, Perplexity Comet, Microsoft Edge, Opera Neon,…
Multiple extensions for Google Chrome and Microsoft Edge have been identified as delivering a sophisticated malware framework designed to steal cryptocurrency, sensitive user data, and browser history. The operation, uncovered by application security company Socket, appears to have been active since early 2024.
More than 737 browser extensions, many impersonating well-known VPN and proxy services, were found on the Chrome Web Store routing user traffic through SOCKS5 proxies. The campaign, identified by researchers at application security company Socket, involved 40 publisher accounts and a shared analytics account, with extensions downloaded nearly 75,000 times, predominantly by users in Russia.
A recent report indicates that 737 Google Chrome extensions have been identified as surreptitiously routing user browser traffic through proxy servers. These extensions, which collectively amassed over 75,000 installations, were primarily observed targeting Russian-speaking users. The core functionality of these extensions appears to be the circumvention of geo-restrictions or service blocks,…
Cybersecurity researchers have issued an alert regarding a malicious Microsoft Visual Studio Code (VS Code) extension, identified as "Solidity Pro" (solidity-pro), which has been observed deploying a browser wallet and credential-stealing malware. The report specifically named two variants of this extension: helper-beeps.solidity-pro and web3devtoolsx.solidity-pro. While these extensions are…
Seventy-seven malicious extensions were discovered on the Open VSX marketplace, impersonating legitimate developer tools to exfiltrate system and development environment information. The "evil twin" campaign, identified by Manifold Security between July 26 and August 1, 2026, involved packages that mimicked existing extensions but were published through unrelated accounts, often with a low…
Google Chrome is preparing to implement a new security feature designed to block extensions that hijack the New Tab page or alter the default search engine, particularly on unmanaged consumer devices. This protection aims to counteract a common abuse where malicious programs exploit Chrome's enterprise policy features to force-install unwanted extensions.
North Korean state-sponsored hackers have released 108 malicious packages and browser extensions across multiple platforms as part of a campaign identified as PolinRider. This operation, linked to previous activities by the same group known as Contagious Interview, targeted developers and users through repositories like npm, Packagist, and the Go ecosystem, as well as the Google Chrome Web Store.