Important: Red Hat Security Advisory: firefox security update

An update for firefox is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

A New Maturity Model for Browser Security: Closing the Last-Mile Risk

Despite years of investment in Zero Trust, SSE, and endpoint protection, many enterprises are still leaving one critical layer exposed: the browser. It's where 85% of modern work now happens. It's also where copy/paste actions, unsanctioned GenAI usage, rogue extensions, and personal devices crea...

CVE-2025-52997

CVE-2025-52997 affects File Browser prior to 2.34.1, where lack of password policy and brute-force protection enables credential guessing attacks that could disclose account passwords. The issue is addressed in version 2.34.1; upgrade to that version or apply the vendor’s fix. Exploitation status...

CVE-2025-2895

IBM Cloud Pak System is affected by HTML injection (CVE-2025-2895) in the following versions: 2.3.3.6, 2.3.36 iFix1, 2.3.3.7, 2.3.3.7 iFix1, 2.3.4.0, 2.3.4.1, and 2.3.4.1 iFix1. The vulnerability enables a remote attacker to inject HTML that executes in the victim’s browser within the hosting sit...

CVE-2025-52904

CVE-2025-52904 affects Filebrowser (v2.32.0) where the Command Execution feature is not scoped per user, allowing shell commands to run with the server process UID and access files across all scopes, potentially exposing the password database and enabling unauthorized read/write access. The repor...

CVE-2025-52902

CVE-2025-52902 concerns the open‑source File Browser project, where the Markdown preview feature in versions before 2.33.7 is vulnerable to Stored Cross‑Site Scripting (XSS). If a user uploads a Markdown file containing JavaScript, the code can be executed when another user previews the file. The...

CVE-2025-6425

An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. This vulnerability affects Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12,...

CVE-2025-6425

CVE-2025-6425 concerns a WebCompat WebExtension issue in Firefox/Thunderbird where enumerating resources could obtain a persistent, browser-identifying UUID that remains across containers and normal/private browsing (not in profiles). Affected: Firefox < 140, Firefox ESR < 115.25, Firefox E...

Amazon Linux 2023 : amazon-cloudwatch-agent (ALAS2023-2025-1029)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1029 advisory. The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags...

Updated chromium-browser-stable packages fix security vulnerabilities

CVE-2025-5063: Use after free in Compositing. CVE-2025-5280: Out of bounds write in V8. CVE-2025-5064: Inappropriate implementation in Background Fetch API. CVE-2025-5065: Inappropriate implementation in FileSystemAccess API. CVE-2025-5066: Inappropriate implementation in Messages. CVE-2025-5281:...

Google Chrome < 137.0.7151.119 Multiple Vulnerabilities

The version of Google Chrome installed on the remote Windows host is prior to 137.0.7151.119. It is, therefore, affected by multiple vulnerabilities as referenced in the 202506stable-channel-update-for-desktop17 advisory. - Use after free in Metrics in Google Chrome prior to 137.0.7151.119 allowe...

TencentOS Server 3: firefox (TSSA-2023:0188)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0188 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

TencentOS Server 2: thunderbird (TSSA-2023:0070)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0070 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

CVE-2025-4233 Prisma Access Browser: Inappropriate implementation in Cache

An insufficient implementation of cache vulnerability in Palo Alto Networks Prisma® Access Browser enables users to bypass certain data control policies...

USN-7566-1: WebKitGTK vulnerabilities

Several security issues were discovered in the WebKitGTK Web and JavaScript engines. If a user were tricked into viewing a malicious website, a remote attacker could exploit a variety of issues related to web browser security, including cross-site scripting attacks, denial of service attacks, and...

Your SaaS Data Isn't Safe: Why Traditional DLP Solutions Fail in the Browser Era

Traditional data leakage prevention DLP tools aren't keeping pace with the realities of how modern businesses use SaaS applications. Companies today rely heavily on SaaS platforms like Google Workspace, Salesforce, Slack, and generative AI tools, significantly altering the way sensitive informati...

DNS rebinding attacks explained: The lookup is coming from inside the house!

My colleague Kevin Stubbings mentioned the topic of DNS rebinding attacks in a previous blog post. No worries if you haven't read it yet though--in this article, we'll walk you through the concept of DNS rebinding from scratch, demystify how it works, and explore why it's a serious browser-based...

Fullscreen BitM Attack Discovered by SquareX Exploits Browser Fullscreen APIs to Steal Credentials in Safari

PALO ALTO, California, 29th May 2025, CyberNewsWire...

CVE-2024-44778

A reflected cross-site scripting XSS vulnerability in the parent parameter in the index page of vTiger CRM 7.4.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload...

CVE-2024-23191

Upsell advertisement information of an account can be manipulated to execute script code in the context of the users browser session. To exploit this an attacker would require temporary access to a users account or an successful social engineering attack to lure users to maliciously configured...