Tag: #browser-security22 results
Google used Gemini-powered AI agents to identify and help fix 1,072 Chrome security bugs in 60 days. The effort is intended to protect Chrome's 3.5 billion active users by finding vulnerabilities before attackers exploit them.
A critical vulnerability named ShadowPrompt has been discovered in Claude's Chrome extension, allowing browser hijacking just by viewing a page. It exploits design flaws and XSS in external components. Users are at risk of AI being manipulated maliciously.
High-severity bug in Chrome's Gemini AI lets malicious extensions spy on PCs. Attackers can expose data or monitor activity. Update and protect advised.
The newly detailed FROST technique allows websites to measure SSD activity via browser-based JavaScript. This poses significant privacy risks by enabling side-channel attacks through storage access patterns.
Google has enabled Device Bound Session Credentials (DBSC) by default in Chrome on Windows. This security feature binds session cookies to the physical device, rendering stolen cookies useless to attackers.
Mozilla released Firefox 150, patching 271 security vulnerabilities discovered by Anthropic’s unreleased Claude Mythos Preview AI model. This builds on Claude Opus 4.6 identifying 22 bugs in Firefox 148 earlier. Mozilla claims the zero-day vulnerability era is nearing its end.
Mozilla leveraged Anthropic's Mythos AI to detect and fix 151 bugs in Firefox. The Firefox team views AI as helpful but not transformative for cybersecurity long-term. They anticipate a challenging transition for software developers.
Security researchers discovered a high-severity vulnerability in Google Chrome's Gemini Live AI panel. Malicious extensions could hijack the panel to inherit unauthorized system privileges. This turned the embedded AI feature into a privilege escalator for rogue add-ons.
Chrome is adopting device-bound session credentials to defend against a growing form of account takeover. The credentials are designed to make stolen session data harder to reuse on another device.
Reports indicate that Google Chrome is installing background components without explicit user consent. This mechanism is being scrutinized for its potential to be exploited by malicious actors.