PEEP Turns Chrome and Edge Into Post-Compromise Backdoors for Host Command Execution

Cybersecurity researchers have disclosed details of a complex Chromium-based post-exploitation toolkit called PEEP that masquerades as a bookmarks extension for the web browser. "Requiring prior administrative or code execution access, its installer injects the extension directly into Chrome/Edge...

The vulnerability of the Workers mechanism in Google Chrome and Microsoft Edge web browsers allows a hacker to execute arbitrary code.

The vulnerability of the Workers mechanism in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the Media component in Google Chrome and Microsoft Edge web browsers allows a hacker to execute arbitrary code.

The vulnerability of the Media component in Google Chrome and Microsoft Edge relates to writing beyond the buffer. Exploiting this vulnerability allows a malicious actor to execute arbitrary code within the sandbox by using a specially created HTML page...

The vulnerability of the GPU components in Google Chrome and Microsoft Edge web browsers allows attackers to compromise the accessibility of protected information.

The vulnerability of the GPU components in Google Chrome and Microsoft Edge is related to a numerical overflow condition. Exploiting this vulnerability allows an attacker to compromise the accessibility of protected information through a specially crafted HTML page...

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge web browsers allows a hacker to execute arbitrary code within the sandbox.

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge browsers relates to the possibility of using memory after it is freed. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code within the browser’s sandbox environment, through the use ...

The vulnerability of the Navigation component in Google Chrome and Microsoft Edge web browsers allows attackers to bypass the sandboxing protection mechanisms.

The vulnerability of the Navigation component in Google Chrome and Microsoft Edge relates to a flaw in data protection mechanisms. Exploiting this vulnerability allows an attacker to bypass the sandbox protection mechanism by using a specially created HTML page...

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

The vulnerability of the Skia component in Google Chrome and Microsoft Edge web browsers allows a hacker to trigger a service failure.

The vulnerability of the Skia component in Google Chrome and Microsoft Edge is related to errors in HTTP request processing. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...

ROS-20260722-73-0023

The vulnerability of the MHTML component in Google Chrome and Microsoft Edge is related to the manipulation of inter-site requests. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information remotely...

Chromium: CVE-2026-13774 Use after free in Extensions

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2026-9971 Inappropriate implementation in iOS

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

The vulnerability of the “Network” control element in Google Chrome and Microsoft Edge browsers allows a hacker to bypass existing security mechanisms.

The vulnerability of the “Network” control element in Google Chrome and Microsoft Edge relates to external control over a web parameter that is assumed to be immutable. Exploiting this vulnerability allows a malicious actor to bypass existing security mechanisms through a specially created HTML...

Chromium: CVE-2026-8570 Type Confusion in V8

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

CVE-2026-1078

An arbitrary file-write vulnerability in Pega Browser Extension PBE affects Pega Robotic Automation version 22.1 or R25 users who are running automations that work with Google Chrome or Microsoft Edge. A bad actor could create a website that includes malicious code. The vulnerability could occur ...

The vulnerability of the WebGL component in Google Chrome and Microsoft Edge browsers allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerability of Google Chrome and Microsoft Edge browsers’ WebGL component relates to reading data beyond the permitted range in memory. Exploiting this vulnerability can allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information through a...

The vulnerability of the WebRTC component in Google Chrome and Microsoft Edge browsers allows a hacker to induce a service failure.

The vulnerability of the WebRTC component in Google Chrome and Microsoft Edge is related to buffer overflows in dynamic memory. Exploiting this vulnerability can allow a remote attacker to cause a service failure through a specially crafted HTML page...

How Manifest v3 forced us to rethink Browser Guard, and why that’s a good thing

As a Browser Guard user, you might not have noticed much difference lately. Browser Guard still blocks scams and phishing attempts just like always, and, in many cases, even better. But behind the scenes, almost everything changed. The rules that govern how browser extensions work went through a...

A Browser Extension Risk Guide After the ShadyPanda Campaign

In early December 2025, security researchers exposed a cybercrime campaign that had quietly hijacked popular Chrome and Edge browser extensions on a massive scale. A threat group dubbed ShadyPanda spent seven years playing the long game, publishing or acquiring harmless extensions, letting them r...

Vulnerability of the Omnibox component in Google Chrome and Microsoft Edge browsers; perform a substitution of the user interface

The vulnerability of the Omnibox component in Google Chrome and Microsoft Edge is related to information representation errors in the user interface. Exploiting this vulnerability can allow an attacker to replace the user interface with a specially created HTML page...

Chromium: CVE-2025-10200 Use after free in Serviceworker

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...