MAL-2026-4200 Malicious code in art-template (npm)

Versions 4.13.3, 4.13.5, and 4.13.6 of art-template were published after an npm account takeover and ship a tampered browser bundle lib/template-web.js that loads remote attacker-controlled JavaScript. The final payload is the Coruna iOS exploit kit, which targets Safari on iPhone and iPad and...

Astra Linux – Vulnerability in WebKit2GTK

A logic issue was addressed through improved checks. This issue is fixed in Safari 16.2, tvOS 16.2, iCloud for Windows 14.1, macOS Ventura 13.1, iOS 16.2, and iPadOS 16.2, as well as watchOS 9.2. Processing maliciously crafted web content may disclose sensitive user information...

Astra Linux – Vulnerability in WebKit2GTK

A memory corruption issue has been resolved through improved state management. This issue is fixed in macOS Ventura 13.3, Safari 16.4, iOS 16.4, and iPadOS 16.4, as well as iOS 15.7.7 and iPadOS 15.7.7. Processing web content may lead to arbitrary code execution. Apple is aware of a report...

Astra Linux – Vulnerability in WebKit2GTK

A port redirection issue has been resolved with additional port validation. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, tvOS 14.4, watchOS 7.3, iOS 14.4, and iPadOS 14.4, as well as Safari 14.0.3. A malicious website may be able t...

Astra Linux – Vulnerability in WebKit2GTK

A logic issue has been resolved through improved state management. This issue is fixed in macOS Monterey 12.3, Safari 15.4, watchOS 8.5, iOS 15.4, and iPadOS 15.4, as well as tvOS 15.4. A malicious website may cause unexpected cross-origin behaviors...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in the QR scanner in Google Chrome on iOS prior to version 90.0.4430.72 allowed an attacker who displayed a QR code to perform domain spoofing using a specially crafted QR code...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in navigation in Google Chrome on iOS prior to version 90.0.4430.72 allowed a remote attacker to bypass navigation restrictions through a crafted HTML page...

Astra Linux – Vulnerability in Chromium

Insufficient policy enforcement in the iOS Security UI of Google Chrome prior to version 121.0.6167.85 allowed a remote attacker to leak cross-origin data through a crafted HTML page. Chromium security severity: Medium...

Astra Linux – Vulnerability in WebKit2GTK

A logic issue has been addressed through improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update 2021-001 Mojave, iOS 14.4, and iPadOS 14.4. A remote attacker may be able to execute arbitrary code. Apple is aware of a report indicating...

Astra Linux – Vulnerability in Chromium

Inappropriate implementations of navigation functions in Google Chrome on iOS before version 90.0.4430.72 allowed a remote attacker to leak cross-origin data through a crafted HTML page...

SUSE CVE-2026-8706

Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. This vulnerability was fixed in Firefox for iOS 151.0...

CVE-2026-8706

Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. This vulnerability was fixed in Firefox for iOS 151.0...

EUVD-2026-30943

Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. This vulnerability was fixed in Firefox for iOS 151.0...

CVE-2026-8706

Summary: CVE-2026-8706 affects Firefox for iOS Reader mode when it runs its own unauthenticated local web server. The issue allows another app on the same device to request arbitrary URLs and receive the response rendered using the signed-in user’s cookies. Affected component: Firefox for iOS Rea...

CVE-2026-8706 Sensitive user data could be leaked to other applications through Reader mode

Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies. This vulnerability was fixed in Firefox for iOS 151.0...

Exploit for Type Confusion in Apple Safari

CVE-2024-23222 — WebKit Type Confusion → iOS 16.4.1 Sandbox Es...

Security Vulnerabilities fixed in Firefox for iOS 151.0 — Mozilla

Firefox for iOS hosted Reader mode on an unauthenticated local web server, allowing another application on the same device to request arbitrary URLs and receive the response rendered with the signed-in user's cookies...

Apple Security Advisory 05-11-2026-2

Apple Security Advisory 05-11-2026-2 - iOS 18.7.9 and iPadOS 18.7.9 addresses buffer overflow, bypass, code execution, denial of service, information leakage, integer overflow, out of bounds write, resource exhaustion, and use-after-free vulnerabilities...

The vulnerability in the Google Chrome web browser for iOS operating systems allows a hacker to increase their privileges.

The vulnerability in the Google Chrome web browser for iOS operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor to enhance their privileges through a specially created HTML page...

Rethinking Side-Channel Analysis: Automated Discovery and Analysis of Side-Channel Leakage with LLM-Assisted Agents

Side-channel attacks exploit unintended information leakage from system behavior and continue to pose serious privacy risks in modern platforms. Despite extensive prior work, side-channel analysis remains largely manual and fragmented, typically assuming predefined target events and a fixed set o...