Astra Linux – Vulnerability in Chromium

Inappropriate implementation in the Service Worker API in Google Chrome prior to version 97.0.4692.99 allowed a remote attacker who had compromised the renderer process to bypass site isolation through a crafted HTML page...

Microsoft Edge (Chromium) < 153.0.4234.32 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 153.0.4234.32. It is, therefore, affected by multiple vulnerabilities as referenced in the September 15, 2026 advisory. - Incorrect authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remot...

CVE-2026-82810

A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExternal.addListener of the component Background Service Worker. Executing a manipulation of the argument sender.id can lead to information...

CVE-2026-82810 extension.vn 2FA Authenticator Extension Background Service Worker chrome.runtime.onMessageExternal.addListener information disclosure

A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExternal.addListener of the component Background Service Worker. Executing a manipulation of the argument sender.id can lead to information...

CVE-2026-82810 extension.vn 2FA Authenticator Extension Background Service Worker chrome.runtime.onMessageExternal.addListener information disclosure

A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExternal.addListener of the component Background Service Worker. Executing a manipulation of the argument sender.id can lead to information...

CVE-2026-82810

extension.vn 2FA Authenticator Extension 1.0.0.2 for Chrome contains an information disclosure vulnerability in the Background Service Worker component. The unrestricted chrome.runtime.onMessageExternal.addListener handler allows an attacker with local access and low privileges to manipulate the ...

EUVD-2026-68657

A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExternal.addListener of the component Background Service Worker. Executing a manipulation of the argument sender.id can lead to information...

CVE-2026-82808 Inbox Foundry ActiveInbox Extension Google OAuth Client Secret service-worker.production-esm.js hard-coded credentials

A vulnerability was identified in Inbox Foundry ActiveInbox Extension up to 7.10.24 on Chrome. Impacted is an unknown function of the file dist/service-worker.production-esm.js of the component Google OAuth Client Secret. Such manipulation leads to hard-coded credentials. The attack can be execut...

PT-2026-83902

A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExternal.addListener of the component Background Service Worker. Executing a manipulation of the argument sender.id can lead to information...

CVE-2026-82810: Exposure of Sensitive Information to an Unauthorized Actor

A weakness has been identified in extension.vn 2FA Authenticator Extension 1.0.0.2 on Chrome. The impacted element is the function chrome.runtime.onMessageExternal.addListener of the component Background Service Worker. Executing a manipulation of the argument sender.id can lead to information...

Edge is dropping older extensions, affecting popular privacy tools

Microsoft is beginning the retirement of Manifest V2 MV2 extensions in Edge this month, with consumer completion targeted for the end of 2026 and managed-enterprise deprecation in early 2027. Microsoft says that change is justified because 95% of the most-used MV2 extensions in the Edge Add-ons...

Service Worker Confidential Data Access

The vulnerability of the Service Worker component in Google Chrome and Microsoft Edge is related to a lack of data security mechanisms. Exploiting this vulnerability could allow an attacker to gain access to confidential data through a specially created HTML page...

CVE-2026-17824

Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...

CVE-2026-17824

Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the Service Worker mechanism in Google Chrome before version 148.0.7778.179 allowed a remote attacker to bypass the same-origin policy through a crafted HTML page. Chromium security severity: High...

Astra Linux – Vulnerability in Chromium

Inappropriate implementation in ServiceWorker in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to inject arbitrary scripts or HTML UXSS via a crafted Chrome Extension. Chromium security severity: Medium...

ROS-20260720-73-0022

The vulnerability of the Service Worker API in the Google Chrome web browser relates to the execution of operations beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code through a specially created HTML page...

ROS-20260720-73-0023

The vulnerability of the Service Worker API in the Google Chrome web browser relates to the execution of operations beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code through a specially created HTML page...

MAL-2026-10266 Malicious code in abuden225 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1055fc13dd3381055731dec99548ae360bcbf6263ffea25b8e89e49f43c9fb05 The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...

MAL-2026-10263 Malicious code in abuden222 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c141ada78ccdede0bb49a76d998fcf07eb4cc60c58cce5fdc1b5933b85a817d The tarball ships auto-publish.sh, a script that republishes the same payload under 100 distinct npm names ishowfeet1-ishowfeet20, nottuff1-nottuff30...