browser extensions

Google and Microsoft disclosed CVE-2026-7940 on May 6, 2026, a medium-severity Chromium vulnerability in V8 that affects Google Chrome before 148.0.7778.96 and can let a malicious Chrome extension execute arbitrary code inside the browser sandbox. The short version is reassuring only if your...

Google and Microsoft disclosed CVE-2026-7949 on May 6, 2026, as a medium-severity Chromium flaw in Skia that affects Google Chrome before version 148.0.7778.96 and can let an attacker with renderer compromise leak cross-origin data through a crafted Chrome extension. That is a narrow bug...

Google disclosed CVE-2026-7976 on May 6, 2026, as a medium-severity use-after-free flaw in Chrome’s Views component, fixed in Chrome 148.0.7778.96, where a malicious extension could achieve arbitrary code execution after persuading a user to install it. That is the dry entry in the vulnerability...

No, the current NVD configuration for CVE-2026-8008 does not appear to be missing the obvious Chrome CPE: it lists Google Chrome versions before 148.0.7778.96 across Windows, Linux, and macOS, while Microsoft’s MSRC entry exists because Edge inherits Chromium security tracking. The more...

CVE-2026-7351 is a high-severity Chromium vulnerability disclosed on April 28, 2026, affecting Google Chrome before 147.0.7727.138, where a race condition in MHTML could let a malicious Chrome extension leak cross-origin data after persuading a user to install it. The plain-English version is...

Microsoft Defender’s recent investigation shows a deceptive new vector for corporate data leakage: malicious Chromium‑based browser extensions that impersonate trusted AI assistant tools and quietly siphon LLM chat histories and browsing telemetry from users — at scale and with real-world...

Adblock Plus’s arrival in Microsoft Edge marked a pivotal moment for Windows 10 users: ad-blocking — long a reason many people stayed with Chrome or Firefox — finally came to Microsoft’s newest browser via the Windows Store, shipped with the Windows 10 Anniversary Update and rolled out to...

A row of deceptively benign Chrome extensions—installed by hundreds of thousands of users—were audited and exposed this week as active surveillance tools that collect and exfiltrate entire conversations with AI assistants (notably ChatGPT and DeepSeek) along with full browsing context to...

A chain of recent disclosures shows that seemingly helpful browser extensions — including a long‑running Chrome add‑on and several “privacy” VPN tools with millions of installs — quietly gained the ability to intercept, record and transmit users’ AI-chat conversations and web traffic, turning...

Security researchers have exposed a family of seemingly benign Chrome and Edge extensions that quietly intercepted entire conversations with major AI chat services and forwarded those chats to remote analytics servers—an exposure that affects millions of users and raises urgent questions about...

A family of popular browser extensions marketed as free VPNs and privacy tools secretly captured and exfiltrated complete conversations with ChatGPT, Google Gemini, Anthropic Claude and several other web-based AI assistants—affecting more than eight million installs and creating one of the most...

Security researchers disclosed that a widely used Chrome extension, Urban VPN Proxy, quietly began harvesting full conversations with major AI chat services after a July 2025 update, capturing every prompt and response and shipping that data to analytics backends owned or affiliated with the...

Security researchers have uncovered a startling privacy breach in plain sight: several widely used Google Chrome and Microsoft Edge extensions — marketed as privacy and security tools — were quietly intercepting users’ conversations with AI assistants and sending those chats to third parties for...

A family of popular browser extensions marketed as free VPNs and privacy tools secretly intercepted entire conversations with ChatGPT, Google Gemini, Anthropic Claude and several other AI chat services, then forwarded those chats to analytics servers and — according to researchers — to a...

A sprawling, seven‑year campaign that quietly converted trusted Chrome and Edge extensions into full‑blown spyware has been revealed — and the fallout touches millions of users who never suspected their productivity or wallpaper add‑ons were silently watching them. Background / Overview Security...

Chrome users who treat the new tab as a daily dashboard now have a clear, lightweight path to a custom homepage that combines weather, RSS headlines, and a synced to‑do list — and the MakeUseOf walkthrough shows exactly how to stitch those pieces together with nothing more than HTML, CSS...

Microsoft’s push to make Edge an “AI browser” took a decisive step this year with an update that gives Copilot the ability to act on users’ behalf inside the browser — opening and navigating tabs, running searches, and executing multi-step tasks like bookings and form-filling when explicitly...

Windows 11’s dark mode finally has a practical, reproducible setup that makes the whole desktop — not just a handful of modern apps — feel cohesive, and the path to get there mixes built‑in settings, small automation tools, and a few targeted third‑party utilities that fill the remaining gaps...

Firefox Nightly users can now summon Microsoft Copilot from the browser sidebar — an optional, opt‑in hook that exposes Copilot’s chat, voice and summarization capabilities inside Firefox while reopening a broader debate about privacy, platform boundaries, and the creeping normalization of...

Microsoft’s short, step-by-step support page for Microsoft Edge lays out the basics for adding, disabling, and removing extensions — but the topic matters far beyond a few clicks. Extensions shape privacy, performance, and security for millions of Windows users, and managing them properly is now...