fortress

One browser engine to rule them all Stealth Chromium engine · v3 Chromium 153 Fortress is a Chromium fork that stops scrapers and browser agents from getting blocked. Bot detectors flag automation by reading the browser fingerprint. Fortress corrects that fingerprint inside Chromium's C++, so the...

chromecookiestealer

Chrome कुकी स्टीलर और इंजेक्टर अपने Remote DevTools प्रोटोकॉल का उपयोग करके Chrome से जुड़ता है और कुकीज़ चुराता/इंजेक्ट करता/साफ़ करता/हटाता है। इससे बहुत प्रेरित: WhiteChocolateMacademiaNut। कुकीज़ JSON ऑब्जेक्ट के रूप में डंप की जाती हैं Chrome के अपने प्रारूप का उपयोग करके। लोड की जाने वाली...

galer

galer /' '/'' | | /'' ' | || | | | '\ ','\ | /' @dwisiswant0 HTML विशेषताओं से crawl करके URL प्राप्त करने का एक तेज़ उपकरण। @omespino के ट्वीट से प्रेरित, जो Chrome DevTools Protocol के माध्यम से JavaScript का मूल्यांकन करके src, href, url और action मान निकालना संभव बनाता है। संसाधन स्थापना...

CVE-2026-100567

OpenClaw is an agent gateway distributed as the npm package 'openclaw'. In versions = 2026.4.5 and 2026.8.1, the Gateway validated a single DNS resolution result for a configured remote Chrome DevTools Protocol CDP hostname, but the raw WebSocket and Playwright transports performed a later,...

EUVD-2026-87484

OpenClaw is an agent gateway distributed as the npm package 'openclaw'. In versions = 2026.4.5 and 2026.8.1, the Gateway validated a single DNS resolution result for a configured remote Chrome DevTools Protocol CDP hostname, but the raw WebSocket and Playwright transports performed a later,...

CVE-2026-100567: Server-Side Request Forgery (SSRF)

OpenClaw is an agent gateway distributed as the npm package 'openclaw'. In versions = 2026.4.5 and 2026.8.1, the Gateway validated a single DNS resolution result for a configured remote Chrome DevTools Protocol CDP hostname, but the raw WebSocket and Playwright transports performed a later,...

PT-2026-99203

Name of the Vulnerable Software and Affected Versions OpenClaw versions 2026.4.5 through 2026.8.0 Description The Gateway validates a single DNS resolution result for a configured remote Chrome DevTools Protocol CDP hostname, but the raw WebSocket and Playwright transports perform a subsequent,...

Exploit for Improper Verification of Cryptographic Signature in Jfrog Artifactory

hpim-training-lab HPIM Training-Case Replication Lab Thi...

Chrome DevTools Technique Enables Authenticated Session Hijacking in Live Windows Browsers

Cybersecurity researchers have detailed a post-exploitation technique that enables the Chrome DevTools Protocol CDP inside a running Google Chrome or Microsoft Edge process on Windows, allowing an operator to access cookies, saved data, and authenticated browser sessions. The technique assumes th...

Malicious code in golaaa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 43f9a2a9514f30f4def10f6a0a21b4abf4f882fa29a45c6b7c93e96490f49c13 The package's main module cdpinject.js runs on require. It disables TLS certificate verification process-wide...

Chaos ransomware's msaRAT: Living off the browser to build a covert C2 channel

Cisco Talos has discovered a new Rust-based remote access trojan RAT we call "msaRAT" attributed to the Chaos ransomware group. The name is derived from the binding names found in the binary: "msaOpen," "msaClose," "msaError," and "msaMessage". msaRAT is implemented using the Tokio asynchronous...

CVE-2026-53633 Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to u...

EUVD-2026-44403

Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to u...

CVE-2026-53633 Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to u...

CVE-2026-53633 Vitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp API that forwarded raw Chrome DevTools Protocol methods without being gated by allowWrite or allowExec, allowing a remote client with exposed browser API metadata to u...

Missing Authorization

Overview @vitest/browser is a Browser running for Vitest Affected versions of this package are vulnerable to Missing Authorization in the cdp API exposed by the browser WebSocket RPC, which allows forwarding of raw Chrome DevTools Protocol methods without proper enforcement of write and exec...

Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

Summary Vitest Browser Mode exposes a cdp API that forwards raw Chrome DevTools Protocol CDP methods over the Vitest browser WebSocket RPC. CDP is not gated by browser.api.allowWrite, browser.api.allowExec, api.allowWrite, or api.allowExec. As a result, disabling Browser Mode write and exec...

GHSA-G8MR-85JM-7XHM Vitest Browser: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE

Summary Vitest Browser Mode exposes a cdp API that forwards raw Chrome DevTools Protocol CDP methods over the Vitest browser WebSocket RPC. CDP is not gated by browser.api.allowWrite, browser.api.allowExec, api.allowWrite, or api.allowExec. As a result, disabling Browser Mode write and exec...

Missing Authorization

Overview vitest is a Next generation testing framework powered by Vite Affected versions of this package are vulnerable to Missing Authorization in the cdp API exposed by the browser WebSocket RPC, which allows forwarding of raw Chrome DevTools Protocol methods without proper enforcement of write...

Missing Authorization

Overview @vitest/coverage-v8 is a V8 coverage provider for Vitest Affected versions of this package are vulnerable to Missing Authorization in the cdp API exposed by the browser WebSocket RPC, which allows forwarding of raw Chrome DevTools Protocol methods without proper enforcement of write and...