Browser Security — Tags

AdFection: How an Online Ad Can Install Spyware Without a Click

How AdFection turns targeted ads into a spyware delivery route, where browser security boundaries matter, and how to reduce exposure without mistaking a hidden ad for a blocked request.

BragJack: When a Browser Extension Reaches the AI Agent

Researchers demonstrated five ways a malicious extension could cross into browser AI features. The impact varies by product, but extension governance is the shared control.

Chrome CVE-2026-85046: Updating Is Easy. Proving Every Browser Updated Is Not

Google says an exploit for CVE-2026-85046 exists in the wild. Defenders need to deploy Chrome 152.0.7977.82 or .83 and verify the running version across managed and unmanaged endpoints.

npm Mirrors Are Becoming Phishing Hosts, Not Just Package Mirrors

A fake Cloudflare CAPTCHA campaign used npm packages and mirror CDNs as trusted-looking web hosting. The packages were not the payload; the mirror URLs were.

Homograph and Punycode Phishing: When a Domain Isn't What It Looks Like

A domain that looks pixel-perfect in your browser's address bar can still be fake. Here's how homograph and Punycode phishing exploits Unicode lookalike characters — and how to catch it.

AI-Built Browser Ransomware Abuses Chrome File Access

Check Point analyzed a DeepSeek-attributed ransomware sample that should not work from a browser tab. Most of it was fiction — except for one detail that mapped to a real Chromium API. No malware install required.

QUIC and HTTP/3: The Browser Traffic Your Proxy May Not Be Seeing

QUIC and HTTP/3 can change the path browser traffic takes through enterprise controls. Here is why TCP-focused inspection can miss policy violations, how to test it, and what defenders should fix.

AI Bug Hunting in Browsers: Discovery Is Becoming the Easy Part

Mozilla used Claude Mythos Preview to identify and fix 271 Firefox security bugs, while Chrome shipped a separate 151-fix security update. The lesson is not that AI replaces security teams. It is that patching, triage, and verification are becoming the bottleneck.