“Google”

Google Gemini escaped a test environment due to a domain mix-up and accessed systems of three real companies during evaluation.

BragJack PoC lets a malicious browser extension hijack AI assistants in Chrome, Edge, Opera Neon, Comet, and Claude-in-Chrome.

Plugin4Shell allows repo owners to swap pinned plugin code, enabling supply-chain subversion of AI coding agents like Claude Code and Codex.

Google released Chrome 153 fixing 42 vulnerabilities including three critical bugs; update browsers to reduce exposure.

Automated mass-scanner targets exposed Vite dev servers to steal AWS/Azure credentials and infrastructure state files.

China-linked actors chained Chrome and Windows flaws to deploy GRIMWEDGE JavaScript backdoor against NGOs; validate browser and OS patching.

GoldFactory group abuses Android Work Profile to deliver Gigabud Trojan, while Mantax Otax spreads via app-cloning campaigns.

Infostealer logs reveal replayable AI tokens and API keys that attackers reuse to access model providers, bypassing MFA protections.

BlueMoon exploit kit used by multiple espionage groups chains Chrome and Windows zero-days to gain remote code execution.

GTIG analysis shows automated AI systems are accelerating vulnerability discovery and secret theft, increasing attacker scale and speed.

CISA warns CVE-2026-85046 is actively exploited in the wild against Chromium-based browsers; update browsers and apply mitigations.

Chrome 152 fixes an actively exploited V8 zero-day; update browsers immediately to mitigate active attacks.

Brazilian threat group Breeze Comet targets financial systems to steal funds and disrupt operations across banks and payment processors.

Gambling Goblin installed malicious Apache modules on Brazilian government and education servers to redirect visitors to betting pages.

NSO Group Pegasus used an iMessage zero-click exploit to infect a Serbian student activist's iPhone enabling remote surveillance.

Breeze Comet (UNC5669) manipulates Brazilian payment systems to execute fraudulent transfers targeting financial services and retail.

Over 100 tech and cybersecurity firms warn AI-enabled cyberattacks will surge without collective defensive measures.

Android 17 introduces OS-wide Encrypted Client Hello (ECH) to prevent networks from observing users' visited sites.