Loading story…
Researchers from KU Leuven have identified a widespread issue where embedded web browsers in devices such as smart TVs, e-readers, game consoles, and cars are significantly outdated compared to their desktop and mobile counterparts. Using a crowdsourced evaluation framework called CheckEngine, the study found that many newly released devices ship with browsers that are several years behind in security updates, exposing users to known vulnerabilities and phishing risks. In some cases, manufacturers do not provide timely security updates for these browsers, despite advertising ongoing support.
The research, presented at the USENIX Symposium on Usable Privacy and Security (SOUPS) 2025, analyzed 53 unique products and 68 software versions, revealing that 24 out of 35 smart TVs and all 5 e-readers tested had browsers at least three years out of date. The findings highlight a critical gap in the security maintenance of embedded browsers, which can leave consumers exposed to cyber threats even on brand-new devices. The lack of regular updates and the presence of obsolete browsers at launch underscore the need for improved security practices in the embedded device ecosystem.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Using the crowdsourced CheckEngine framework, the researchers documented cases including the Boox Note Air 3 tablet and platforms such as Steam, Ubisoft Connect, and AMD Adrenalin, where outdated browsers remained in use. The study also found that vendors often failed to deliver timely security updates despite advertising update support, prompting calls for stronger regulatory action.
Researchers from KU Leuven's DistriNet Research Unit found that embedded browsers in products such as smart TVs, e-readers, gaming applications, and cars were often years out of date and exposed to known vulnerabilities. Their analysis showed that even newly released devices frequently shipped with obsolete browser components, increasing risks such as phishing and privilege escalation.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google has released a security update for its Chrome browser, addressing 13 vulnerabilities, four of which are rated high severity. Among the most notable is a use-after-free flaw in the Digital Credentials feature (CVE-2025-13633), which could allow remote attackers to exploit affected systems. The update brings Chrome to version 143.0.7499.40/.41 for Windows and macOS, and 143.0.7499.40 for Linux, and users are strongly advised to update promptly to mitigate risk, as attackers often exploit such vulnerabilities before widespread patch adoption. In addition to the Digital Credentials issue, a significant data leak vulnerability was discovered in the WebXR component (CVE-2025-12443), affecting all major Chromium-based browsers, including Chrome, Edge, Brave, and Opera. The flaw, which could expose heap memory and pointer data, required user interaction with a malicious page to be exploited. Google responded rapidly to the responsible disclosure, issuing a fix within 24 hours and updating the stable Chrome release within two weeks. Users of all Chromium-based browsers are urged to update to the latest versions to ensure protection against these and other recently patched vulnerabilities.
Jun 29, 2026
Google released an urgent security update for its Chrome browser to address a critical vulnerability identified as CVE-2025-11756. This flaw was discovered in Chrome’s Safe Browsing component, a feature responsible for protecting users from malicious websites and harmful downloads. The vulnerability is classified as a use-after-free issue, which occurs when memory is accessed after it has been freed, potentially allowing attackers to execute arbitrary code on affected systems. If exploited, this vulnerability could enable cybercriminals to gain unauthorized access to a user’s device, install malware, exfiltrate sensitive data, or compromise user accounts. Google rated the severity of this vulnerability as High, underscoring the significant risk it poses to user privacy and system integrity. The issue was responsibly disclosed by a security researcher known as “asnine” on September 25, 2025, who was awarded $7,000 through Google’s bug bounty program for their contribution. Google publicly acknowledged the researcher’s efforts and emphasized the importance of collaboration with the security community in preventing such flaws from reaching end users. To mitigate the risk, Google released a security patch in Chrome version 141.0.7390.107/.108 for Windows and Mac, and version 141.0.7390.107 for Linux. Users were urged to update their browsers immediately to ensure protection against potential exploitation. The vulnerability’s presence in the Safe Browsing component is particularly concerning due to the elevated privileges with which this feature operates. Attackers leveraging this flaw could bypass key security controls, making prompt patching essential. The update was rolled out through Chrome’s standard update channels, and Google provided guidance for users to verify their browser version. No evidence of active exploitation in the wild was reported at the time of disclosure, but the public availability of the patch increased the urgency for users and organizations to apply the update. Security experts highlighted the ongoing risk posed by use-after-free vulnerabilities in modern browsers, noting that such flaws remain a common target for attackers. The incident reinforced the value of bug bounty programs in identifying and remediating critical security issues before they can be weaponized. Organizations were advised to ensure all endpoints running Chrome were updated promptly and to monitor for any signs of compromise. The swift response by Google demonstrated the company’s commitment to user security and the effectiveness of coordinated vulnerability disclosure.
Jun 29, 2026
Google publicly released proof-of-concept exploit code for a long-unfixed Chromium vulnerability in the Browser Fetch API, exposing Chrome, Microsoft Edge, Brave, Opera, and other Chromium-based browsers to abuse by any malicious website a user visits. Researcher **Lyra Rebane** reported the flaw in late 2022, but it remained unresolved for years despite being internally classified as serious. The bug lets an attacker register a Service Worker and create a background fetch task that can persist as a covert communication channel, enabling browser monitoring, anonymous proxying, traffic redirection, and potential browser-based botnets; some implementations reportedly keep the connection alive even after the browser closes or the device reboots. At the same time, Google issued Chrome Stable Channel updates for versions before `148.0.7778.178/179`, and government and vulnerability trackers highlighted multiple newly disclosed flaws fixed in that release. Those included `CVE-2026-9120`, a high-severity WebRTC use-after-free that could allow remote code execution in the browser sandbox via a crafted HTML page; `CVE-2026-9126`, a DOM use-after-free with similar impact; and `CVE-2026-9121`, a GPU out-of-bounds read that could lead to heap corruption. The contrast between patched Chrome memory-corruption bugs and the still-unfixed Browser Fetch issue raised concern because the published exploit code lowers the barrier to abuse across millions of Chromium users, prompting recommendations to restrict Service Worker use, disable background fetch where possible, monitor outbound browser traffic, and consider browser isolation in enterprise environments.
Jun 29, 2026