UI misrepresentation in FileSystem in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Missing authorization in Views in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Race condition in Editing in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)
UI misrepresentation in Browser in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)
Improper input validation in Auth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)
UI misrepresentation in SecurityIndicators in Google Chrome on on iOS prior to 154.0.8037.57 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: High)
Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially perform out of bounds memory access via a crafted video file. (Chromium security severity: Low)
Lunex is a sophisticated information stealer malware targeting Ukrainian-speaking users via fake CAPTCHA pages. It uses a four-stage attack chain and employs Bring Your Own Vulnerable Driver (BYOVD) techniques with AMD's PDFWKRNL.sys to disable kernel-level security monitoring. The malware targets seven Chromium-based browsers to extract credentials and cryptocurrency wallets, maintaining persistence through PowerShell-based Chrome Native Messaging Hosts. It operates a large command-and-control infrastructure across multiple countries and is run by a financially motivated threat actor from the CIS region as a Malware-as-a-Service platform.
A security update for Chromium addresses multiple vulnerabilities including buffer overflows, use-after-free errors, out-of-bounds writes, missing or incorrect authorization, race conditions, information leaks, improper input validation, and UI misrepresentations across various components such as ANGLE, GPU, ServiceWorker, DevTools, V8, and others. These issues are fixed in Chromium version 154.0.8037.57. The update resolves a wide range of security flaws that could impact the browser's stability and security.
Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Medium)
RemotePanel and BoundSiphon are two previously undocumented .NET malware components delivered via a ClickFix infection chain. RemotePanel masquerades as the Windows Time service to establish persistent remote access, offering operators PowerShell control, file and process management, screen access, modular hidden VNC, and fleet management. It uses a BNB Smart Chain contract to dynamically resolve its active command and control server, enabling infrastructure rotation without rebuilding the RAT. BoundSiphon operates primarily in memory, targeting browser credentials, sessions, cryptocurrency wallets, password manager data, and documents protected by Chromium App-Bound Encryption. The modular design separates persistent access from data theft, allowing operators to swap components independently while maintaining operational capabilities. No known active exploitation or patches are reported.
The domain third-party[.]com, historically used as a documentation placeholder similar to example.com, has been compromised and now serves ClickFix lures to Windows users while displaying harmless content to other operating systems. Since at least June 2026, Windows visitors receive a fake Cloudflare verification page that poisons the clipboard with a malicious PowerShell command, instructing users to press Win+R and paste the payload. The domain appears in over 1,500 files across 1,700+ repositories from trusted sources including Chromium, Sanity, and Vercel. Unlike example.com, third-party[.]com is not IANA-reserved, allowing adversaries to register and weaponize it. The attack leverages social engineering to bypass security tools by using signed Windows binaries, making detection difficult through traditional scanning methods.
CVE-2026-50228 is a vulnerability in Acer NitroSense V5 (up to version 5.2.63) where the Electron DevTools endpoint is exposed on localhost TCP port 9993 with Chromium remote debugging enabled. This allows an unauthenticated local attacker to execute JavaScript in the privileged application context, leading to arbitrary code execution.
Novu provides an API for sending notifications through multiple channels. Prior to 3.18.0, Novu's @novu/js In-App Inbox and the @novu/react Inbox component accept a notification call-to-action redirect.url from the v1 cta.data object and pass it through apps/api/src/app/inbox/utils/notification-mapper.ts and packages/js/src/ui/components/Notification/DefaultNotification.tsx to the navigate function in packages/js/src/ui/context/InboxContext.tsx without validating its URL scheme. An authenticated organization member or environment API-key holder can store a javascript: redirect with target _self in an in-app workflow. When a recipient using a Chromium-based browser clicks the notification, window.open executes the redirect in the current inbox-hosting origin, which can expose session material and permit authenticated actions in a customer application or the self-hosted Novu dashboard. This issue is fixed in version 3.18.0.
A security update for webkit2gtk3 on Red Hat Enterprise Linux 9 addresses multiple vulnerabilities in the ANGLE component used by chromium-browser. These include out-of-bounds memory access, heap buffer overflows, use-after-free, integer overflows, type confusion, and insufficient validation of untrusted input. The update is rated as important by Red Hat Product Security and fixes numerous CVEs affecting ANGLE. The vulnerabilities could potentially lead to memory corruption and other security issues.
A server-side request forgery (SSRF) vulnerability exists in the Omnibox component of Google Chrome on Android versions prior to 153.0.8010.52. This vulnerability allows a remote attacker to bypass system access restrictions by leveraging social engineering and crafted network traffic. The issue has been assigned CVE-2026-93384 and is rated as medium severity by Chromium security. No CVSS score is provided. No explicit patch or remediation details are available in the provided data.
An information leak vulnerability exists in the Paint component of Google Chrome versions prior to 153.0.8010.52. This flaw allows a remote attacker to obtain sensitive information by tricking a user into visiting a specially crafted HTML page. The vulnerability has been assigned CVE-2026-93385 and is rated with medium severity by the Chromium security team.