Loading story…
Chromium fixed CVE-2026-95344, a Chrome DevTools vulnerability that could let a malicious extension execute JavaScript inside another extension's content-script isolated world. The attack combined a time-of-check/time-of-use flaw in DevTools keyboard-shortcut forwarding with insufficient authorization for evaluation in a debugger-selected call frame.
An attacker could pause execution, select a victim extension's frame, and invoke victim-scoped APIs, including chrome.storage.local; the issue was demonstrated against MetaMask. Chromium's DevTools frontend changes validate forwarded shortcuts and block ExtensionServer evaluation while paused, with release notes planned for Chrome M154.
Trace attribution and downstream blast radius.
4 events from the most recent confirmed update back to the earliest known activity.
A vulnerability later assigned CVE-2026-95344 was reported against Chromium 151.0.7922.138 on Windows 11. The report showed that a malicious extension with a DevTools page could use shortcut-forwarding TOCTOU behavior and debugger call-frame authorization gaps to execute in another extension’s isolated world, including a demonstration against MetaMask 13.44.0.
The vulnerability’s release-notes target was updated to Chrome M154.
The fixes, including validation of keyboard shortcuts in ExtensionServer and preventing ExtensionServer evaluation while paused, were rolled into Chromium main.
Google marked the DevTools frontend issue fixed. The remediation included the “Validate keyboard shortcuts in ExtensionServer” change, which validates forwarded shortcut inputs.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
crbug.com
Open sourcechromium.googlesource.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google fixed **CVE-2026-95301**, a high-severity Chromium Site Isolation bypass in the extensions accessibility-automation infrastructure. A compromised, site-locked web renderer could bind the previously unprotected `RendererAutomationRegistry` interface and register a rogue automation receiver without browser-side authorization. If a legitimate `chrome.automation` consumer was active, the rogue receiver could obtain serialized accessibility-tree data from other origins and tabs, including visible page text, non-password form values, ARIA content, and cross-site frame URLs; the flaw also had potential cross-profile and Incognito exposure. Chromium now verifies that the calling renderer hosts an enabled extension with automation permission and terminates unauthorized renderers; the fix was targeted for Chrome M154 release notes.
Sep 23, 2026
A serious unpatched **Chromium** vulnerability was accidentally exposed after Google engineers marked the issue as fixed without shipping a patch, causing the bug report and proof-of-concept to become public. The flaw, originally reported in 2022, abuses the **Background Fetch API** to keep a Service Worker and malicious JavaScript running after the browser is closed and, in some cases, even after a device reboot. Affected products include **Chrome**, **Microsoft Edge**, **Brave**, **Opera**, **Vivaldi**, and **Arc**. The bug could let attackers abuse victims’ browsers for proxying traffic, launching DDoS activity, opening websites, and tracking user behavior; Google later re-hid the report and said it is working on a fix. Separately, researchers analyzing the **VoidStealer** infostealer found it can bypass Chrome’s **Application-Bound Encryption (ABE)** on Windows by attaching to the browser as a debugger, intercepting the moment Chrome decrypts protected data, and extracting the master key from memory. That technique enables theft of cookies, sessions, and other sensitive browser data, and the risk extends to other Chromium-based browsers using the same protection model. Together, the disclosures show that Chromium ecosystems face both browser-level persistence abuse and post-compromise data theft, with defenders urged to watch for unusual download-menu behavior, keep browsers updated as fixes arrive, and harden endpoints against infostealer activity.
Jun 29, 2026
Palo Alto Networks Unit 42 disclosed a **high-severity Google Chrome vulnerability** in the new **Gemini Live in Chrome** side panel, tracked as **CVE-2026-0628**, that could have allowed **malicious browser extensions with only basic permissions** to hijack the Gemini panel and effectively “tap into” the browser environment. The reported impact included **privilege escalation** enabling access to sensitive resources such as the victim’s **camera and microphone**, the ability to **take screenshots of any website**, and access to **local files and directories**. Unit 42 reported responsible disclosure to Google and stated that Google shipped a fix in **early January** ahead of public disclosure. Dark Reading coverage echoed Unit 42’s findings, emphasizing that the flaw highlights emerging risks in **agentic/AI-enabled browsers** where AI side panels run with elevated capabilities, and that enterprise environments face amplified exposure if users install untrusted extensions. Separate reporting described unrelated supply-chain activity affecting developer and browser extensions: Socket reported suspicious, non-repository code added to **Aqua Trivy’s VS Code extension** on **OpenVSX** (versions `1.8.12`/`1.8.13`) that attempted to invoke local AI coding assistants and exfiltrate/report data, while Rescana detailed a **QuickLens Chrome extension** takeover used for credential/crypto theft and a **ClickFix** social-engineering technique; these are distinct incidents from CVE-2026-0628 but reinforce the broader risk of extension ecosystems.
Jun 29, 2026