CVE-2025-48618

In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48618

In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48618

In processLaunchBrowser of CommandParamsFactory.java, there is a possible browser interaction from the lockscreen due to improper locking. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2025-48580

In connectInternal of MediaBrowser.java, there is a possible way to access while in use permission while the app is in background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2025-48580

In connectInternal of MediaBrowser.java, there is a possible way to access while in use permission while the app is in background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

Privacy Practices of Browser Agents

This paper presents a systematic evaluation of the privacy behaviors and attributes of eight recent, popular browser agents. Browser agents are software that automate Web browsing using large language models and ancillary tooling. However, the automated capabilities that make browser agents...

PT-2025-49528

Name of the Vulnerable Software and Affected Versions ENOVIA Collaborative Industry Innovator versions 3DEXPERIENCE R2022x through 3DEXPERIENCE R2025x Description A reflected Cross-site Scripting XSS issue exists in ENOVIA Collaborative Industry Innovator. This allows an attacker to execute...

Fedora 43 : chromium (2025-3c51a0ed51)

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-3c51a0ed51 advisory. Update to 143.0.7499.40 High CVE-2025-13630: Type Confusion in V8 High CVE-2025-13631: Inappropriate implementation in Google Updater High...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google, Inc. in the United States. A security vulnerability exists in Google Android, which stems from an issue with a logic error in the MediaBrowser.java file that could lead to background access rights...

EUVD-2025-201555

Malicious code in ssf-desktop-api-browser npm...

[SECURITY] Fedora 43 Update: chromium-143.0.7499.40-1.fc43

Chromium is an open-source web browser, powered by WebKit Blink...

CVE-2025-34257

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting XSS vulnerability in the /rmm/v1/action/defined endpoint. When an authenticated user creates a task, the definedname value is stored and later rendered in the Overview page without HTML sanitization. An...

Zero-Click Agentic Browser Attack Can Delete Entire Google Drive Using Crafted Emails

A new agentic browser attack targeting Perplexity's Comet browser that's capable of turning a seemingly innocuous email into a destructive action that wipes a user's entire Google Drive contents, findings from Straiker STAR Labs show. The zero-click Google Drive Wiper technique hinges on connecti...

EUVD-2025-201431

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting XSS vulnerability in the /rmm/v1/plugin-config/dashboards/menus endpoint. When an authenticated user adds or edits a dashboard entry, the label and path values are stored in plugin configuration data and...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: rancher-machine, aws-ebs-csi-driver-fips, spiffe-helper, pulumi-language-dotnet, harbor-scanner-trivy, nats-top, langfuse, nri-rabbitmq, nri-haproxy, prometheus-blackbox-exporter-fips, sftpgo-plugin-kms, flux-source-controller-fips, plugin-barman-cloud-fips,...

CVE-2025-62223 Microsoft Edge (Chromium-based) for Mac Spoofing Vulnerability

...

Google Chrome Use After Release Vulnerability (CNVD-2026-07245)

Google Chrome is a web browser developed by Google Inc. Google Chrome suffers from a use-after-free vulnerability that stems from Storage objects being accessed even after they have been released prematurely. An attacker could use this vulnerability to trick a user into visiting a specially craft...

PT-2025-49281

Advantech WISE-DeviceOn Server versions prior to 5.4 contain a stored cross-site scripting XSS vulnerability in the /rmm/v1/action/schedule endpoint. When an authenticated user adds a schedule to an existing task, the schedule name is stored and later rendered in schedule listings without HTML...

Microsoft Edge (Chromium) < 143.0.3650.66 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 143.0.3650.66. It is, therefore, affected by multiple vulnerabilities as referenced in the December 4, 2025 advisory. - Inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote...

CVE-2025-61729 vulnerabilities

Vulnerabilities for packages: pluto, spiffe-helper, terraform-provider-time, fuse-overlayfs-snapshotter, k6, rancher-system-upgrade-controller, gke-gcloud-auth-plugin, metrics-agent, terraform-docs, petname, op-geth, jaeger-operator, kubernetes-dashboard-auth, sftpgo-plugin-kms, nri-nginx,...