Topic
Browser security covers vulnerabilities, exploits, and protections affecting web browsers, including engine flaws, extensions, and data exposure.
Hacktron reports that GPT-5.6 Sol Ultra built a complete Chrome/V8 exploit chain in a controlled test for $1,596.89 of model compute. The benchmark handed the model the source tree and the public security-fix commits, so the figure covers only the compute for one lab task.
Reality
LastPass added shadow AI discovery and sensitive-data warnings to Business Max, run from the browser extension its customers already use. Teams on that tier get a warning and an audit log for browser AI use, and the release describes hard blocks only for web categories.
Reality
CVE-2026-87491 gives a crafted web page code execution inside Chrome's sandbox. The fix only takes effect when the browser restarts, and long-running sessions carry that exposure until they do.
Perspective Coverage
5 publishersReality
Google shipped 108 security fixes to the Chrome stable channel on September 22, eleven of them rated Critical and seven of those in graphics components a crafted page can drive. None were reported as exploited.
Reality
Proofpoint says a shared toolkit called BlueMoon chained two V8 flaws that Chromium had fixed in public but Chrome had not yet shipped, plus a Windows kernel bug that elevates only on older builds.
Reality
V8 says 60% of the Chrome exploits caught in the wild between 2021 and 2023 started in its own code, and that the logic bugs behind them are out of reach of both Rust and memory tagging, so the work went into containment.
Reality
Anthropic's red team says the scarce reverse-engineering skill that used to give defenders weeks is no longer the bottleneck. It measured that on Firefox and Windows kernel fixes, where a 19-day median gap counts as fast.
Reality
Google says an exploit exists in the wild for CVE-2026-85046, a type confusion in Chrome's V8 engine, and it is the sixth Chrome zero-day the company has patched under active attack since January.
Perspective Coverage
9 publishersReality
Two of the patched bugs need nothing more than a page load, according to Malwarebytes. Chrome applies fixes on restart, so uptime is the exposure operators actually own.
Reality
Unit 42's three techniques all assume malware is already running on the box. That makes this an endpoint and browser-profile problem, not a reason to stall a passkey deployment.
Reality