That AI Extension Helping You Write Emails? It’s Reading Them First

Unit 42 has identified high-risk AI browser extensions that masquerade as productivity tools but actually steal user data, intercept prompts, and exfiltrate passwords. These malicious extensions pose a significant privacy and security risk to users by accessing sensitive information within the browser. No specific affected versions or patches are currently documented. The threat is categorized as high severity due to the potential for data theft and unauthorized access.

• unit42.paloaltonetworks.com/high-risk-gen-ai-browser-extensions/ (opens in a new tab)

• php2shell one week later: Why one exploit doesn’t work everywhereHighVulnerability2026-10-30
• ZDI-26-839: MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-29
• ZDI-26-843: MLflow SHAP load_explainer Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-29
• ZDI-26-845: MLflow Statsmodels _load_model Deserialization of Untrusted Data Remote Code Execution VulnerabilityHighVulnerability2026-10-29
• Open-source tool for unpacking stripped Android native (.so) malware: static RegisterNatives recovery, ARM64 OLLVM (BR X8) deobfuscation, and Dobby anti-Frida tracingTool2026-10-28