Tag archive
Extension allowlisting only works when the policy engine, the permission review and the removal path are all defined. Blocklists that lag behind publication are not a control.
A new malware campaign is targeting Google Chrome and Microsoft Edge users by force-installing...
A developer teaching themselves WebGPU accidentally discovered that a simple infinite loop in a shader can freeze an entire Mac — cursor, desktop and all — until it force-restarts. Apple's confirmed it, but doesn't consider it a security issue.
A Hacker News headline turned a contained V8 type-confusion bug into 'sandbox RCE in all Chromium versions.' The real story is more interesting: how Chromium's defense-in-depth actually held, why V8 keeps producing this exact bug class, and what the coverage got backwards in both directions.
Chrome Web Store deletes the last Manifest V2 extensions on 31 August 2026 Summary. The...
Check Point Research recently analyzed nearly 3,000 files attributed to DeepSeek, identifying a...
The browser has evolved into the primary operating environment for modern enterprises, making it a...
AI-Powered Security Testing Revolutionizes Browser Development Mozilla's Firefox browser...
LinkedIn's JavaScript silently probes your browser for 30+ installed extensions using web_accessible_resources. Here's how the technique works, what it reveals about you, and how to protect yourself.
CVE-2026-0628 lets malicious Chrome extensions hijack the Gemini AI panel to access cameras, files, and run arbitrary code. Patch now.
A phishing campaign uses google-prism.com to install a fake Google security PWA that steals MFA codes via WebOTP API, exfiltrates GPS and contacts, and acts as a browser RAT.
LinkedIn runs hidden JavaScript that probes thousands of Chrome extensions, encrypts the results, and sends them to third-party servers -- all without user consent or any mention in their privacy policy.