⚡ Weekly Recap: Password Manager Flaws, Apple 0-Day, Hidden AI Prompts, In-the-Wild Exploits & More

Cybersecurity today moves at the pace of global politics. A single breach can ripple across supply chains, turn a software flaw into leverage, or shift who holds the upper hand. For leaders, this means defense isn't just a matter of firewalls and patches—it's about strategy. The strongest...

A week in security (August 18 – August 24)

Last week on Malwarebytes Labs: Clickjack attack steals password managers’ secrets Grok chats show up in Google searches All Apple users should update after company patches zero-day vulnerability in all platforms Google settles YouTube lawsuit over kids’ privacy invasion and data collection...

Linux Distros Unpatched Vulnerability : CVE-2017-6504

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - WebUI in qBittorrent before 3.3.11 did not set the X-Frame-Options header, which could potentially lead to clickjacking. CVE-2017-6504 Note that Nessus relies o...

Clickjack attack steals password managers’ secrets

Sometimes it can seem as though everything's toxic online, and the latest good thing turned bad is here: Browser pop-ups that look like they're trying to help or authenticate you could be programmed to steal data from your password manager. To make matters worse, most browser extension-based...

DOM-Based Extension Clickjacking Exposes Popular Password Managers to Credential and Data Theft

Popular password manager plugins for web browsers have been found susceptible to clickjacking security vulnerabilities that could be exploited to steal account credentials, two-factor authentication 2FA codes, and credit card details under certain conditions. The technique has been dubbed Documen...

The vulnerability in the web client of IBM Datacap Navigator software, which is used for collecting and processing documents with IBM Datacap, allows a perpetrator to carry out a clickjacking attack.

The vulnerability in the IBM Datacap Navigator software, a document collection and processing tool, relates to an improper limitation on the visible layers of the user interface. Exploiting this vulnerability could allow a malicious actor to carry out a clickjacking attack remotely...

The vulnerability in the web client of IBM Datacap Navigator software, which is used for collecting and processing documents with IBM Datacap, allows a perpetrator to carry out a clickjacking attack.

The vulnerability in the IBM Datacap Navigator software, a document collection and processing tool, relates to the user interface’s false representation of critical information. Exploiting this vulnerability could allow an attacker to carry out a clickjacking attack remotely...

Linux Distros Unpatched Vulnerability : CVE-2025-5267

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Red Hat Enterprise Linux - firefox: thunderbird: Clickjacking vulnerability could have led to leaking saved payment card details Ubuntu Linux - A clickjacking...

Linux Distros Unpatched Vulnerability : CVE-2020-26962

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-origin iframes that contained a login form could have been recognized by the login autofill service, and populated. This could have been used in...

Linux Distros Unpatched Vulnerability : CVE-2025-6434

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The exception page for the HTTPS-Only feature, displayed when a website is opened via HTTP, lacked an anti-clickjacking delay, potentially allowing an attacker ...

Linux Distros Unpatched Vulnerability : CVE-2021-29987

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - After requesting multiple permissions, and closing the first permission panel, subsequent permission panels will be displayed in a different position but still...

Brave Android 1.81.131 Security Fixes

Added clickjacking protection on DDNS interstitials as reported on HackerOne by newfunction. Upgraded Chromium to 139.0.7258.66 — refer to Google Chrome advisories for inherited CVEs...

Brave Desktop 1.81.131 Security Fixes

Added clickjacking protection on DDNS interstitials as reported on HackerOne by newfunction. - Fixed inactive split view tab displaying a permission prompt as reported on HackerOne by frozzipies. Upgraded Chromium to 139.0.7258.66 — refer to Google Chrome advisories for inherited CVEs...

Linux Distros Unpatched Vulnerability : CVE-2024-2609

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The permission prompt input delay could expire while the window is not in focus. This makes it vulnerable to clickjacking by malicious websites. This...

WakaTime: Double Clickjacking Attack on WakaTime OAuth Authorization Flow at https://wakatime.com/oauth/authorize

The WakaTime OAuth authorization flow was vulnerable to a double-clickjacking attack. The attack allowed an attacker to trick users into unknowingly clicking the "Connect my WakaTime account" button in the consent dialog, enabling the attacker to register an OAuth application, capture the...

RockyLinux 8 : thunderbird (RLSA-2025:8756)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:8756 advisory. thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link CVE-2025-3909 thunderbird: Sender Spoofing via Malformed From Header in...

RLSA-2025:8756 Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fixes: thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link CVE-2025-3909 thunderbird: Sender Spoofing via Malformed From Header in Thunderbird CVE-2025-3875 thunderbird: Unsolicited File Download,...

firefox security update

An update is available for firefox. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Mozilla Firefox is an open-source web browser, designed for standards...

RLSA-2025:8308 Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fixes: firefox: thunderbird: Clickjacking vulnerability could have led to leaking saved payment card details CVE-2025-5267 firefox: thunderbird: Potential local code execution ...

CVE-2025-34114

A client-side security misconfiguration vulnerability exists in OpenBlow whistleblowing platform across multiple versions and default deployments, due to the absence of critical HTTP response headers including Content-Security-Policy, Referrer-Policy, Permissions-Policy,...