CVE-2026-84354

Incorrect authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: High...

CVE-2026-84354

CVE-2026-84354 is an incorrect authorization flaw in the FileSystem component of Google Chrome prior to 152.0.7977.75. A remote attacker, leveraging social engineering , can execute arbitrary code outside the sandbox via a crafted HTML page, rated CVSS 9.6 (Critical) . The bug (Chromium issue 498...

CVE-2026-84353

Use after free in Shared Tab Groups in Google Chrome on on Android prior to 152.0.7977.75 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. Chromium security severity: Critical...

CVE-2026-84353

CVE-2026-84353 is a critical use-after-free vulnerability in Shared Tab Groups of Google Chrome prior to version 152.0.7977.75 (Android/Linux) and 152.0.7977.76 (Windows/Mac). A remote attacker leveraging social engineering (e.g., luring a user to a malicious website or HTML email) can execute ar...

Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems

Brazilian financial services, retail, and e-commerce organizations have become the target of a financially motivated threat actor dubbed Breeze Comet formerly UNC5669 since 2024. Google Threat Intelligence Group GTIG and Mandiant teams described the threat actor as "specializing in manipulating...

Threat Actors Don’t Want Better Attacks. They Want Repeatable Ones

The most common way into a company last year was to ask. A web page tells the visitor to prove they are not a robot. While they read the instructions, it quietly places a command on their clipboard. Then it talks them through opening a terminal and pasting it in. The technique is called ClickFix,...

PT-2026-84546

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description Improper input validation in the DataTransfer component allows a remote attacker to bypass system access restrictions via a co-installed application. This issue can be exploited by...

PT-2026-84560

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description A use after free issue exists in the TabStrip component. This occurs when a program continues to use a pointer after it has been freed, which can lead to memory corruption. A remote...

PT-2026-84548

Name of the Vulnerable Software and Affected Versions Google Chrome on Android versions prior to 152.0.7977.75 Description Incorrect authorization in the Autofill feature allows a remote attacker to obtain sensitive information. This is achieved by leveraging social engineering and directing the...

PT-2026-84556

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description Incorrect authorization in the TabStrip component allows a remote attacker to potentially execute arbitrary code outside the sandbox. This requires the attacker to have already...

PT-2026-84564

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description Incorrect authorization in the FileSystem component allows a remote attacker to execute arbitrary code outside the sandbox. This is achieved by leveraging social engineering to entice a...

PT-2026-84567

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 152.0.7977.75 Description Improper input validation in the Omnibox allows a remote attacker to bypass the web origin policy through crafted network traffic, typically leveraging social engineering. Recommendatio...

ThreatsDay: 296K IoT Botnet, 100+ Water Systems Targeted, SharePoint RCE Chain + 27 New Stories

A fake login page. A fake security scan. A fake productivity app. Apparently, pretending to be useful is still one of the easier ways into a machine. The rest of the week gets stranger: botnets borrowing AI, command traffic hiding in public infrastructure, malicious tools waiting before showing...

Fake Apple Pay charge brings the classic tech support scam to your phone

iPhone users are being targeted in a new tech support scam, using a fake Apple Pay notification to trick users. Tech support scams that use fake warnings to push victims into calling a phone number have been around for years, but this page has been designed specifically for phones. Instead of a...

CVE-2026-79276

A flaw was found in Google Chrome's FileSystem component. This improper privilege management vulnerability allows a remote attacker, leveraging social engineering, to bypass system access restrictions. The exploitation occurs when a user interacts with a specially crafted HTML page...

CVE-2026-79258

A flaw was found in WebXR within Google Chrome. This incorrect authorization vulnerability allows a remote attacker, by leveraging social engineering tactics and a specially crafted HTML page, to obtain sensitive cross-origin data. This could lead to unauthorized information disclosure...

CVE-2026-79055

A flaw was found in Google Chrome on Android. An information leak vulnerability exists in the Sharing feature. A local attacker, by leveraging social engineering tactics, could exploit this flaw through a co-installed application, potentially leading to the disclosure of sensitive information...

CVE-2026-79225

A flaw was found in chromium-browser. This incorrect authorization vulnerability allows a remote attacker to bypass system access restrictions. The attacker can achieve this by leveraging social engineering techniques through user interface UI interaction...

CVE-2026-79089

A flaw was found in Google Chrome's Transactions Platform on Android. A race condition vulnerability allows a remote attacker, through social engineering and a specially crafted HTML page, to bypass system access restrictions. This could lead to unauthorized access to sensitive system functions...

CVE-2026-79022

A flaw was found in Google Chrome. A remote attacker, leveraging social engineering, could exploit a user interface UI misrepresentation vulnerability. By crafting a malicious HTML page, the attacker could potentially spoof UI elements, which might mislead users...