Уязвимость компонента Extensions браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю обойти ограничения безопасности

Уязвимость компонента Extensions браузеров Google Chrome и Microsoft Edge связана с недостатками контроля доступа. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, обойти ограничения безопасности путем загрузки вредоносного расширения...

Microsoft Removes 119 Edge Extensions That Hid Malware in Images and Fonts

Microsoft has shut down a long-running malicious extension operation on the Edge Add-ons store that hid its payloads inside ordinary image and font files, then woke up days after install to steal credentials and run ad fraud. The company calls it StegoAd, a mash-up of steganography and adware, an...

Уязвимость компонента Extensions браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю выполнить произвольный код

Уязвимость компонента Extensions браузеров Google Chrome и Microsoft Edge связана с использованием памяти после ее освобождения. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код через вредоносный сетевой трафик...

Уязвимость компонента Extensions (Расширения) браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю раскрыть защищаемую информацию

Уязвимость компонента Extensions Расширения браузеров Google Chrome и Microsoft Edge связана с ошибкой подтверждения источника данных. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, раскрыть защищаемую информацию...

Уязвимость компонента Extensions (Расширения) браузеров Google Chrome и Microsoft Edge, позволяющая нарушителю обойти существующие механизмы безопасности

Уязвимость компонента Extensions Расширения браузеров Google Chrome и Microsoft Edge связана с нарушением механизма защиты данных. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, обойти существующие механизмы безопасности с помощью специально созданной HTML-страницы...

Fake TikTok Downloaders on Chrome and Edge Spying on 130,000 Users

Over 130,000 users are at risk from fake TikTok downloader extensions on Chrome and Microsoft Edge. Researchers discovered these malicious tools use device fingerprinting to spy on users and steal sensitive browser data...

Malicious Chrome extensions can spy on your ChatGPT chats

Researchers discovered 16 malicious browser extensions for Google Chrome and Microsoft Edge that steal ChatGPT session tokens, giving attackers access to accounts, including conversation history and metadata. The 16 malicious extensions 15 for Chrome and 1 for Edge claim to improve and optimize...

ROS-20251216-7371

A vulnerability in the Extensions component of Google Chrome and Microsoft Edge browsers is related to incorrect resource initialization. Exploitation of the vulnerability may allow a remote attacker to gain unauthorized access to protected information...

ROS-20251216-7358

A vulnerability in the Extensions component of Google Chrome and Microsoft Edge browsers is related to flaws in the implementation of security checks for standard elements. Exploitation of the vulnerability could allow an attacker acting remotely to bypass existing security restrictions...

A Browser Extension Risk Guide After the ShadyPanda Campaign

In early December 2025, security researchers exposed a cybercrime campaign that had quietly hijacked popular Chrome and Edge browser extensions on a massive scale. A threat group dubbed ShadyPanda spent seven years playing the long game, publishing or acquiring harmless extensions, letting them r...

“Sleeper” browser extensions woke up as spyware on 4 million devices

Researchers have unraveled a malware campaign that really did play the long game. After seven years of behaving normally, a set of browser extensions installed on roughly 4.3 million Chrome and Edge users’ devices suddenly went rogue. Now they can track what you browse and run malicious code insi...

Chromium: CVE-2025-8581 Inappropriate implementation in Extensions

Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2025-8576 Use after free in Extensions

Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

Chromium: CVE-2025-3070 Insufficient validation of untrusted input in Extensions

This CVE was assigned by Chrome. Microsoft Edge Chromium-based ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information...

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge browsers allows attackers to bypass existing security restrictions and perform substitution attacks on user interfaces.

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge involves bypassing authentication through spoofing. Exploiting this vulnerability allows a malicious actor to circumvent existing security restrictions and replace the user interface...

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge browsers allows a hacker to replace the user interface.

The vulnerability of the Extensions component in Google Chrome and Microsoft Edge is related to improper security checks for standard elements. Exploiting this vulnerability could allow a malicious actor to replace the user interface with a specially created HTML page...

The vulnerability of the Extensions component of Microsoft Edge and Google Chrome browsers allows a perpetrator to access confidential information.

The vulnerability of the Extensions component of Microsoft Edge and Google Chrome lies in the improper security checks for standard elements. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information remotely...

The vulnerability of the Extensions API of Microsoft Edge and Google Chrome browsers allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Extensions API for Microsoft Edge and Google Chrome relates to improper security checks for standard elements. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information through a specially created HTML pa...

The vulnerability of the Extensions API of Google Chrome and Microsoft Edge browsers allows a malicious actor to install any extension they desire.

The vulnerability of the Extensions API for Google Chrome and Microsoft Edge is related to insufficient data validation. Exploiting this vulnerability could allow an attacker to install any desired extension by using a specially created HTML page...

The vulnerabilities of Google Chrome and Microsoft Edge browser extensions, which allow a hacker to trigger a service failure.

The vulnerability of browser extensions in Google Chrome and Microsoft Edge relates to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to cause a service failure by loading a specially created extension...