malicious extensions

Google has fixed CVE-2026-13791, a High-severity input-validation flaw in Chrome’s Downloads component affecting versions before 150.0.7871.47, after researchers found that an attacker who persuaded a user to install a malicious extension could use a crafted Chrome Extension to execute arbitrary...

Google Chrome CVE-2026-14154 is a DevTools UI-spoofing flaw disclosed June 30, 2026, affecting Chrome versions before 150.0.7871.47 and requiring an attacker to persuade a user to install a malicious Chrome extension. NVD lists the issue as sourced from Chrome, while CISA’s enrichment assigns a...

Google disclosed CVE-2026-13029 on June 24, 2026, as a high-severity use-after-free vulnerability in Chrome’s Web Authentication component affecting desktop versions before 149.0.7827.197, with exploitation requiring a user to install a malicious Chrome extension that could trigger heap...

Insufficient policy enforcement in Chrome DevTools is back in the spotlight with CVE-2026-5901, a newly published Chromium issue that could let a malicious extension bypass enterprise host restrictions for cookie modification in Google Chrome versions prior to 147.0.7727.55. The bug is rated Low...

Type confusion bugs in browser engines rarely stay theoretical for long, and CVE-2026-5914 is another reminder that the most dangerous path into a modern browser is often not the web page itself, but the extension ecosystem wrapped around it. Google says the flaw affected Chrome prior to...

A new browser-based threat dubbed the “Cookie-Bite” attack is capturing the cybersecurity community’s attention, raising major concerns over the integrity of authentication within cloud environments like Microsoft Azure, Microsoft 365, Google Workspace, AWS, and others. The discovery, recently...