CVE-2026-16404

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Spoofing issue in Firefox for Android...

CVE-2026-16397

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Clickjacking issue in the WebExtensions component in Firefox for Android...

CVE-2026-16373

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the Privacy component in Firefox for Android...

A week in security (July 20 – July 26)

Last week on Malwarebytes Labs: Don’t get fooled by TikTok resin art scams Call of Duty Mobile scam uses fake free points to steal player accounts OpenAI’s agent escaped its sandbox during a security test Google wants to store a selfie video of your face Beyond the Play Store: How Android threats...

v72-ionstack-exploit

smt878u-ionstack-poc Pure-C, host-assisted re-root proof of c...

Exploit for Use After Free in Linux Linux_Kernel

CVE-2026-43499 PoC for Galaxy S24 Ultra SM-S928U1 Device-sp...

Exploit for CVE-2026-12960

CVE-2026-12960 Improper Export of Android Application Compo...

Exploit for Use After Free in Linux Linux_Kernel

unplus CVE-2026-43499 Futex PI UAF: The core logic code for...

Exploit for Use After Free in Linux Linux_Kernel

GhostLock — OnePlus 15T !中文https://img.shields.io/badge/语...

Exploit for Use After Free in Arm Bifrost_Gpu_Kernel_Driver

Aristotle ADB Enable A minimal Android app that turns on AD...

Exploit for Use After Free in Arm Bifrost_Gpu_Kernel_Driver

Exploit for CVE-2022-38181 The write up can be found here...

Linux Distros Unpatched Vulnerability : CVE-2026-16424

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in GPU in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker who had compromised the renderer process to potentially...

Linux Distros Unpatched Vulnerability : CVE-2026-16419

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Out of bounds read and write in ANGLE in Google Chrome on Android prior to 150.0.7871.182 allowed a remote attacker to potentially perform a sandbox escape via ...

Linux Distros Unpatched Vulnerability : CVE-2026-16404

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Spoofing issue in Firefox for Android. This vulnerability was fixed in Firefox 153. CVE-2026-16404 Note that Nessus relies on the presence of the package as...

Linux Distros Unpatched Vulnerability : CVE-2026-16373

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information disclosure in the Privacy component in Firefox for Android. This vulnerability was fixed in Firefox 153. CVE-2026-16373 Note that Nessus relies on t...

openSUSE 16: libmariadb-devel / libmariadb3 / libmariadb_plugins / etc (openSUSE-SU-2026:21409-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21409-1 advisory. This update for mariadb-connector-c fixes the following issue: - CVE-2026-44172: mysqlrealescapestring incorrectly handled big5 bsc1266438. Changes for...

Linux Distros Unpatched Vulnerability : CVE-2026-16397

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Clickjacking issue in the WebExtensions component in Firefox for Android. This vulnerability was fixed in Firefox 153. CVE-2026-16397 Note that Nessus relies on...

Don’t get fooled by TikTok resin art scams

Resin art has become a popular corner of TikTok, with some videos attracting millions of views. But not every glossy, colorful post is what it claims to be. Scammers are using the look of handmade resin art to trick buyers, collectors, and even fellow artists into sending money for work that eith...

Call of Duty Mobile scam uses fake free points to steal player accounts

Call of Duty Mobile players should watch out for a phishing campaign disguised as a free Call of Duty Points giveaway. Victims are asked to log in with their email address and password to claim free Call of Duty Points CP, the game's premium currency. They're then redirected to a second page aski...

Beyond the Play Store: How Android threats really spread

You probably think of your phone's security the way you think of your front door: as long as you're downloading apps from the Play Store, you're safe. And for the most part, that's true. Google reviews apps before they’re published. But some apps reach your phone without ever passing through the...