TL;DR Google has released Chrome 157.0.8103.50/.51 to fix nine security bugs, including a Chrome zero-day that attackers are already using. The flaw, CVE-2026-125350, is a use-after-free bug in Chrome's XML component. In its advisory, Google says it "is aware that an exploit for CVE-2026-125350 exists in the wild." Why It Matters A live exploit means attackers have a working weapon right now.

Understanding how broad browser permissions, automatic background updates, and shared browsing environments expose cryptocurrency wallets to critical security vulnerabilities.

TL;DR Google has promoted Chrome 157 to the stable channel with 213 security fixes. This Chrome security update brings version 157.0.8103.38 to Linux and 157.0.8103.38/.39 to Windows and Mac. Seven of the flaws are rated critical. Chrome 157 patches seven critical memory bugs in graphics and rendering code, plus 77 high-severity flaws. Google has not said any of them are exploited in the wild.

https://www.osintinvestigate.com A simple ChatGPT shared link could become a serious cybersecurity threat. Security researchers from Parameter discovered a vulnerability that allowed attackers to execute malicious code within a logged-in ChatGPT session and potentially access private conversations. In this episode, we explore how the attack worked, how a browser sandbox was bypassed, why MathLive and insecure message handling played a crucial role, and how OpenAI responded with a security fix. Discover the implications for AI security, data privacy, and the protection of sensitive information in the age of generative artificial intelligence. The vulnerability was reported through OpenAI's bug bounty program, classified as P1, and patched on October 26, 2026. No real-world exploitation was reported by the researchers. Find out why this discovery highlights the importance of secure AI architectures and responsible vulnerability disclosure.

TL;DR Socket researchers uncovered three malicious Firefox extensions that impersonated the Phantom, Jupiter, and Bitget cryptocurrency wallets on Mozilla's official store. Using Unicode homoglyphs to spoof legitimate brand names, these malicious Firefox wallet extensions capture BIP-39 recovery phrases and private keys. Before Mozilla removed the listings, the extensions routed stolen secrets to brand-named subdomains under a single command server. Delivery and Attribution…

TL;DR Google has released Chrome 156.0.8078.79/.80 for Windows and Mac and 156.0.8078.79 for Linux. This Chrome 156 security update fixes 21 vulnerabilities, including one critical Chrome vulnerability in MediaStream. The rollout covers both the Stable and Extended Stable channels. The release patches 1 critical, 19 high and 1 medium severity flaw. Google has not reported any exploitation. Update Chrome and restart the browser to apply the fixes.

TL;DR Google has released Chrome 156.0.8078.79/.80 for Windows and Mac and 156.0.8078.79 for Linux. This Chrome 156 security update fixes 21 vulnerabilities, including one critical Chrome vulnerability in MediaStream. The rollout covers both the Stable and Extended Stable channels. The release patches 1 critical, 19 high and 1 medium severity flaw. Google has not reported any exploitation. Update Chrome and restart the browser to apply the fixes.

TL;DR Socket researchers uncovered three malicious Firefox extensions that impersonated the Phantom, Jupiter, and Bitget cryptocurrency wallets on Mozilla's official store. Using Unicode homoglyphs to spoof legitimate brand names, these malicious Firefox wallet extensions capture BIP-39 recovery phrases and private keys. Before Mozilla removed the listings, the extensions routed stolen secrets to brand-named subdomains under a single command server. Delivery and Attribution…

2026年10月29日付のChrome公式投稿（156.0.8078.79/.80、修正21件・Critical1件）を整理。Googleヘルプの手順で社内PCの版と再起動待ちを確認し、点検表と再起動をお願いする連絡文を作る方法をまとめます。コードや設定変更は不要で、確認日つきで記録できます。

TL;DR Google has released Chrome 156.0.8078.73/.74 for Windows and Mac and 156.0.8078.73 for Linux. This Chrome security update fixes 52 vulnerabilities, including four critical Chrome vulnerabilities. One of them could let attackers run code outside the browser sandbox. Google has not reported any exploitation. Update Chrome now and restart the browser. Why It Matters Browser bugs are attractive targets, since a single malicious page can trigger them.

Bay Area Labs has linked 60 Chrome extensions with 2.3 million installs to a single Estonian company. According to its report, the OffiDocs Chrome extensions include office editors, PDF tools and a free VPN. Furthermore, 37 of them "hex-encode/obfuscate and exfiltrate full URLs" that users visit. A Sprawling Extension Network The extensions sit under four publisher accounts: officeonlinesystems, RedcoolMedia, ApkOnline android online and RunApps.

Google Chrome scam warnings help users identify suspicious websites and avoid online scams with enhanced browser security.

Chrome Scam Protection adds AI-powered warnings to help users identify phishing, fake websites, and online scams.

 Major browser vendors and certificate trust stores have blacklisted eight intermediate certificates issued by Indian certificate authority eMudhra following the discovery of recoverable private keys. The compromised keys could have been used to create fraudulent HTTPS certificates and impersonate secure websites on affected systems.  The affected certificates were issued in April 2025, and blocked in Firefox and Chrome on October 17 by Mozilla and Google, followed by Apple on October 19 and Microsoft on October 20. Sectigo took revocation action, and Cloudflare updated its services in response.  Google stated the keys had been generated with insufficient entropy, allowing an attacker to reconstruct them and use them to create fraudulent, but otherwise valid, certificates. Although eMudhra has revoked the certificates in question and informed downstream trust stores, some systems may require software updates before ceasing to trust the compromised certificate authorities.   Mozilla’s Dennis Jackson has published a tool to help users check whether their systems trust the affected certificates, warning that “reconstructing the private keys [was] actually kind of easy” due to a severe flaw in the certificate creation process.  Jackson revealed that, aside from the final byte, all the keys were zero, and therefore could be reconstructed almost instantly using the baby-step giant-step algorithm to solve the discrete logarithm problem. He added that several people had independently managed to recover the keys.  Certificate Transparency logs have revealed no evidence of abuse of the compromised keys, but this cannot guarantee that they were not used to compromise HTTPS sites, as not all clients enforce Certificate Transparency policies. Anyone whose systems trust the compromised certificates could be at risk, as the keys could have been used to impersonate secure websites without detection.   eMudhra stated that the error was caused by a script used in the key generation ceremony which resulted in a second, weaker key pair being created. This was used to generate certificate signing requests because the labels on the keys were similar enough to mislead the process.  The company stated that the certificates in question were created for export to its data centres in the United States and Europe to satisfy data sovereignty requirements, and were not in production use, with the exception of one.   eMudhra identified human errors at several points during the process, but stated that it was investigating potential coding issues and process weaknesses, including maker-checker controls, which are meant to prevent errors by ensuring that no single individual has control over any critical process. eMudhra has undertaken to recheck all key generation ceremonies it has performed during the coming week.  The incident demonstrates the critical importance of key generation security, internal controls and certificate revocation, and the need for organisations to update their software and trust stores following a security incident to prevent further compromises.