54 matches found
Extensions Component Data Compromise
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability allows an attacker to manipulate data integrity through a specially created HTML page...
Extensions Component DoS
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...
Extensions Component DoS
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge relates to the inclusion of functionality from a unreliable management domain. Exploiting this vulnerability can allow an attacker to cause service interruptions...
Edge is dropping older extensions, affecting popular privacy tools
Microsoft is beginning the retirement of Manifest V2 MV2 extensions in Edge this month, with consumer completion targeted for the end of 2026 and managed-enterprise deprecation in early 2027. Microsoft says that change is justified because 95% of the most-used MV2 extensions in the Edge Add-ons...
Extensions Component DoS
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability could allow a remote attacker to cause a service failure...
ROS-20260721-73-0009
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge relates to a flaw in data protection mechanisms. Exploiting this vulnerability allows an attacker to bypass existing security measures through a specially created HTML page...
Extensions Component Bypass Security Restrictions
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to lack of access control. Exploiting this vulnerability allows a malicious actor to bypass security restrictions by downloading the malicious extension...
119 Edge extensions promised useful tools, instead downloaded malware
Microsoft has removed 119 extensions from the Edge add-on store which were all tied to one adware campaign. In a paper titled "Inside StegoAd: How We Disrupted a Massive Malicious Extension Campaign," Microsoft researchers detail how they uncovered and dismantled a sophisticated malware campaign...
Microsoft Removes 119 Edge Extensions That Hid Malware in Images and Fonts
Microsoft has shut down a long-running malicious extension operation on the Edge Add-ons store that hid its payloads inside ordinary image and font files, then woke up days after install to steal credentials and run ad fraud. The company calls it StegoAd, a mash-up of steganography and adware, an...
Extensions Component Code Execution
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability allows a remote attacker to execute arbitrary code through malicious network traffic...
Extensions Component Disclosure Protected Information
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to a data source confirmation error. Exploiting this vulnerability can allow an attacker to disclose protected information remotely...
Extensions Component Bypass Security
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to a flaw in data protection mechanisms. Exploiting this vulnerability allows an attacker to bypass existing security measures through a specially created HTML page...
Fake TikTok Downloaders on Chrome and Edge Spying on 130,000 Users
Over 130,000 users are at risk from fake TikTok downloader extensions on Chrome and Microsoft Edge. Researchers discovered these malicious tools use device fingerprinting to spy on users and steal sensitive browser data...
Malicious Chrome extensions can spy on your ChatGPT chats
Researchers discovered 16 malicious browser extensions for Google Chrome and Microsoft Edge that steal ChatGPT session tokens, giving attackers access to accounts, including conversation history and metadata. The 16 malicious extensions 15 for Chrome and 1 for Edge claim to improve and optimize...
ROS-20251216-7358
A vulnerability in the Extensions component of Google Chrome and Microsoft Edge browsers is related to flaws in the implementation of security checks for standard elements. Exploitation of the vulnerability could allow an attacker acting remotely to bypass existing security restrictions...
ROS-20251216-7371
A vulnerability in the Extensions component of Google Chrome and Microsoft Edge browsers is related to incorrect resource initialization. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information...
A Browser Extension Risk Guide After the ShadyPanda Campaign
In early December 2025, security researchers exposed a cybercrime campaign that had quietly hijacked popular Chrome and Edge browser extensions on a massive scale. A threat group dubbed ShadyPanda spent seven years playing the long game, publishing or acquiring harmless extensions, letting them r...
“Sleeper” browser extensions woke up as spyware on 4 million devices
Researchers have unraveled a malware campaign that really did play the long game. After seven years of behaving normally, a set of browser extensions installed on roughly 4.3 million Chrome and Edge users’ devices suddenly went rogue. Now they can track what you browse and run malicious code insi...
Extensions Component Unauthorized Access
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
Extensions Component Bypass Security Restrictions
The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to a flaw in data protection mechanisms. Exploiting this vulnerability allows an attacker to bypass security restrictions remotely...