Chrome
Chrome security: zero-days, browser updates and exploitation reports. Compare individual advisories and follow how our coverage develops.
Latest report:
Matching reports 16
-
Chrome 156 Closes 353 Security Flaws, Including Six Critical Memory-Safety Bugs
Chrome 156 reaches stable with 353 security fixes, including six critical memory-safety issues across core components.
-
Chrome Adds ClickFix Command Warnings for Enhanced Protection Users
Google says Chrome will scan copied commands for Enhanced Protection users to warn on ClickFix; Apple says Safari blocks identity tracking.
-
Langflow Command Injection Draws Exploitation Attempts as Version 1.9.0 Fixes RCE
Authenticated Langflow flaw enables OS command execution via MCP Stdio config; Previdian reports exploitation attempts and urges upgrade to 1.9.0.
-
Chrome 155 Fixes 247 Security Issues, With Critical Bugs Reaching Beyond the Sandbox
Google's Chrome 155 desktop update fixes 247 security issues, including critical use-after-free flaws enabling code execution outside sandbox.
-
Popular Chrome Ad Blocker Accused of Secretly Harvesting Browsing and AI Chat Data
Poper Blocker, a Chrome extension with 2M users, accused of harvesting browsing history, AI chats, and screenshots via remote commands.
-
WeaselBiscuit Turns npm Imports Into a Chrome Extension Data-Theft Channel
13 malicious npm packages deploy WeaselBiscuit, a JS stealer that harvests Chrome extension LevelDB data, clipboard and keystrokes via in-memory loader.
-
China-Linked Hackers Chain Chrome and Windows Zero-Days to Breach NGOs
China-linked UTA0560 and APT31 chained Chrome and Windows zero-days via spear-phishing to breach NGOs, deploying GRIMWEDGE and credential-stealing malware.
-
BlueMoon Exploit Kit Gives Four Espionage Groups a Shared Chrome-to-Windows Attack Chain
Four espionage groups use BlueMoon exploit kit chaining Chrome V8 flaws and Windows ALPC bug to escape sandbox and deploy payloads.
-
Fortinet Fixes Critical Authentication Flaws in FortiMonitorOnSight and Chrome Extension
Fortinet patched 10 flaws, including critical JWT auth bypass in FortiMonitorOnSight and Chrome extension proxy bug. Update FortiPAM and extension now.
-
Chrome V8 Zero-Day Exploited in Active Attacks: Update to Version 153 Now
Google fixes actively exploited Chrome V8 zero-day CVE-2026-87491 plus 229 flaws. Update to Chrome 153.0.8010.36/37 and restart now.
-
PEEP Turns Chrome and Edge Into Persistent Backdoors After a Host Breach
PEEP is a post-exploitation framework that turns Chrome and Edge into persistent backdoors to steal cookies, monitor browsing, and run OS commands.
-
Chrome Fixes Sixth Zero-Day of 2026: Active Attacks Target V8 Engine
Google patched CVE-2026-85046, a V8 type confusion zero-day exploited in the wild. Update Chrome to 152.0.7977.82+ immediately to stay protected.
How this coverage is selected
Articles are selected by explicit entity names or reviewed aliases in their original headlines, within the last 365 days. This is a chronology of our reporting, not a complete incident history. Separate stories do not imply a shared attack campaign. Read each article for its sources, affected versions and uncertainties.