project
Microsoft's Chromium-based web browser bundled with Windows, featuring built-in AI tools, extension support, and enterprise management capabilities.
No evidence-backed relationships are recorded.
Shopify added WebMCP checkout tools on September 28 that update payment and place an order once the buyer confirms. The spec is still a draft with no Firefox or Safari implementation, so tools belong on the open session behind a review step.
Reality
Graz University of Technology researchers used file-change alerts to catch 95.7% of another Windows user's Firefox site visits from an unprivileged account. On shared hosts and on servers that run services under their own accounts, separation between users is weaker than the account model suggests.
Reality
In Cloudflare's lab test, RFC 9842 dictionary compression sent a 272 KB JavaScript file as a 2.6 KB delta, where gzip produced 92.2 KB. Teams that deploy small fixes often can now send returning visitors the change, where today those visitors download the whole bundle again.
Reality
Ontinue says the Python implant takes tasking from SharePoint dead drops over Graph API, relays interactive sessions through Teams TURN, and moves all of it through the victim's own headless Edge.
Reality
The new backdoor, HOOKEDGE, is a Windows batch script that beacons to a free webhook.site endpoint. Insikt Group calls the BlueDelta attribution moderate confidence, resting on overlap with the older HEADLACE implant.
Perspective Coverage
3 publishersReality
Socket found 19 Chrome and Edge extensions carrying crypto-draining code, five of them bought from their original owners. The malware landed in updates after each listing had earned real installs, which is exactly what a one-time vetting pass never re-checks.
Reality
Opera asked judges in Luxembourg to force Microsoft Edge under the Digital Markets Act and lost, which tells platform teams that crossing the user thresholds only opens a market investigation the gateway argument can still close.
Reality
SOCRadar says the toolkit needs administrative or code execution access first, then writes itself into Chrome and Edge profiles with integrity values the browser accepts and bridges to a native host binary that runs shell commands.
Reality
RoamProxy's extension mints a new proxy hostname on every save because Firefox and Edge kept reusing connections authenticated with the old username. Any gateway that routes by username on one host and port hits the same silent failure.
Reality
Graz University of Technology researchers used OS file-change alerts to identify sites another Windows user visited with 97.8% accuracy in Firefox. Every attack needs code already running on the device; on Android, an app that asks for no permissions is enough.
Reality
Gal Weizman showed that one malicious extension can take over the AI agents in Chrome, Comet, Edge, Neon and Claude in Chrome, with bounties from all five vendors to show for it. Installation is the only precondition.
Perspective Coverage
3 publishersReality
getImageData can only ever read pixels your own code painted, and the screen-capture workaround reaches the rest of the display only with a permission prompt and a recording banner. Chromium has shipped window.EyeDropper since late 2021.
Reality
Dashlane's answer to employees drifting back to typed passwords is a per-domain block inside the browser extension. The work that decides whether it helps happens upstream, when an admin picks which login pages go on the list.
Reality
Elastic Security Labs describes a Brazilian banking operation that edits a Chrome or Edge profile and then signs its own edit using the OSCrypt and App-Bound keys sitting on the same machine. The browser loads the extension as approved.
Reality
Microsoft rated 114 of the 973 Critical, but 284 score 8.0 or higher and two Important-severity Windows bugs are already under attack. One 9.1 advisory in the same cycle came from outside Microsoft.
Reality
Elastic Security Labs tied 1,515 infections, almost all in Brazil, to a loader that waits for Chrome to close and then writes its own extension into the profile directory with integrity hashes the browser accepts.
Reality
Forever Security showed the same technique working against Gemini in Chrome, Comet, Edge, Opera Neon and the Claude extension. Google and Microsoft have shipped fixes; the other three findings rest on the researchers' own account.
Reality
Elastic Security Labs says the Brazilian crew it calls REF9334 has been running this since at least May 2025, writing its extension into Chromium's Secure Preferences and reading C2 addresses out of an Ethereum smart contract.
Reality
Microsoft's July update fixes 622 vulnerabilities, 62 of them rated critical. The two it says attackers are already using, in AD FS and SharePoint Server, sit below that line, so exploited status has to order the work.
Reality
Proofpoint says two of the three bugs in the BlueMoon chain were fixed in public Chromium source before they reached stable Chrome. Defenders could close one link: an old Windows build.
Reality
Security · September 10, 2026 · 1 publisher
Build · September 4, 2026 · 1 publisher
Leadership · September 2, 2026 · 1 publisher
Build · September 2, 2026 · 1 publisher
Build · August 31, 2026 · 1 publisher
Security · August 30, 2026 · 1 publisher
Build · August 30, 2026 · 1 publisher
Build · August 27, 2026 · 1 publisher
Security · August 26, 2026 · 1 publisher
Security · August 24, 2026 · 1 publisher
Build · August 22, 2026 · 1 publisher
Invest · August 20, 2026 · 2 publishers
Build · August 16, 2026 · 1 publisher