Tag

Exploit

All articles tagged with #exploit

security1 month ago•2 min saved

Chrome patches in-the-wild V8 zero-day as part of 230 fixes

Google pushed Chrome updates to fix 230 vulnerabilities, including CVE-2026-87491 — an out-of-bounds write in V8 that has been exploited in the wild to run arbitrary code in the sandbox. The patch, for Windows/macOS versions 153.0.8010.36/37 and Linux 153.0.8010.36, also addresses multiple WebGL and WebPackaging flaws and follows seven actively exploited Chrome zero-days reported this year. Users of Chrome and other Chromium-based browsers should update promptly, noting that some bug details may remain restricted until most users are patched. OpenAI Codex Security is credited for a separate high-severity finding in WebPackaging.

via The Hacker News|

#chrome #exploit #security

technology1 month ago•4 min saved

Zero-Click WeChat Worm Hijacks Accounts Through Incoming Calls

Researchers from Calif demonstrated a zero-click worm that hijacks a WeChat account via an incoming call from a trusted contact, without the user answering. Once the exploit runs, the attacker can read and send messages, make calls, and act as the account owner, though only the account and not the device is compromised. Tencent patched the bug with Android/iOS updates and blocked the exploit on its servers; no real-world attacks have been reported. The attack relies on the caller being in the contact list, and full technical details will be released later.

via thehackernews.com|

#exploit #security #technology

security1 month ago•1 min saved

Chrome Patch Fends Off Actively Exploited V8 Zero-Day

Google released a Chrome security update that patches 12 vulnerabilities, including an actively exploited V8 zero-day (CVE-2026-85046) that enables remote code execution via a crafted HTML page. An exploit already exists in the wild, and Google urges users to update to Chrome 152.0.7977.82/83 on Windows and macOS, and 152.0.7977.82 on Linux; the update also fixes five other CVEs (CVE-2026-2441, -3909, -3910, -5281, -11645), bringing the total of actively exploited Chrome zero-days addressed this year to six.

via The Hacker News|

#chrome #cve-2026-85046 #exploit

security3 months ago•20 min saved

BootROM-style exploit hits iPhone A12/A13, researchers reveal

Security researchers disclosed a bootROM-style exploit for iPhone models with A12 and A13 chips, a checkm8-like vulnerability that operates at boot level. Like other bootrom flaws, it cannot be patched on existing devices and would only be addressed with new hardware, highlighting ongoing hardware-level risk for affected iPhones.

via The Register|

#apple #bootrom #exploit

games3 months ago•13 min saved

Forza Horizon 6 Clamps Down on Hummer Credit Exploit, Restores Accounts and Grants Free Car

Players used a specific Hummer glitch in Forza Horizon 6’s Eliminator mode to earn tens of millions of credits in minutes. Playground Games temporarily removed Eliminator, then said it would delete the ill-gotten credits and reset affected accounts to a maximum of 10 million. No bans were issued, and all players will receive a free 2021 McLaren Sabre once the mode returns after a hotfix.

via Kotaku|

#cheaters #credits #exploit

security4 months ago•1 min saved

GreatXML Bypass Unlocks BitLocker via WinRE XML Files

Security researcher Chaotic Eclipse unveiled GreatXML, a new Windows BitLocker bypass that places crafted unattend.xml and Recovery/WindowsRE/ReAgent.xml on the recovery partition and, after rebooting into WinRE, spawns a shell with unrestricted access to the BitLocker volume. It builds on a recent Defender-related exploit and is the second BitLocker bypass from the researcher, with Microsoft having patched a prior bypass (YellowKey CVE-2026-45585) this Patch Tuesday.

via The Hacker News|

#bitlocker #defender #exploit

security4 months ago•1 min saved

Chrome Patches Wildly Exploited V8 Zero-Day CVE-2026-11645

Google rolled out updates to fix 74 Chrome vulnerabilities, including CVE-2026-11645—a critical out-of-bounds read/write in V8 that is being exploited in the wild to execute arbitrary code via a crafted HTML page. Users should update to Chrome 149.0.7827.102/103 on Windows/macOS and 149.0.7827.102 on Linux, and apply fixes in other Chromium-based browsers as available. Google notes this is the fifth actively exploited Chrome zero-day addressed this year, alongside CVE-2026-2441, 2026-3909, 2026-3910, and 2026-5281.

via The Hacker News|

#chrome #cve-2026-11645 #exploit

technology4 months ago•5 min saved

Public exploit for long-unpatched Chromium flaw threatens millions

Google published exploit code for a long-unpatched Chromium vulnerability that uses the Browser Fetch API to trigger a persistent backdoor via malicious sites, potentially turning millions of Chromium-based browsers into a botnet; disclosed in 2022 and rated S1, the flaw remained unfixed for 29 months, affecting Chrome, Edge and other Chromium-based browsers while Firefox and Safari are unaffected.

via Ars Technica|

#chromium #cybersecurity #exploit

technology4 months ago•4 min saved

Zero-Day Bypass Lets Attackers Crack Windows 11 BitLocker TPM in Seconds

A zero-day named YellowKey bypasses Windows 11’s default TPM-only BitLocker protection by exploiting a crafted FsTx/Transactional NTFS folder on a USB drive, enabling a CMD prompt and full drive access during Windows Recovery without needing the BitLocker key. Microsoft is investigating. The flaw highlights that TPM-only BitLocker may be insufficient security, with experts recommending BIOS passwords and PINs in addition to TPM protections.

via Ars Technica|

#bitlocker #cybersecurity #exploit

gaming5 months ago•13 min saved

Two-Decade Glitch Unlocks Bully's BB Rifle in Free Roam

A YouTuber named JustGarrison demonstrates a glitch that lets Bully players bring the BB rifle into free roam, a weapon normally limited to the shooting range; the exploit works without mods and can damage NPCs, hinting the rifle was either unfinished or cut during development. Rockstar apparently didn’t intend for it to be used outside the minigame, likely due to safety concerns given Bully’s school setting.

via Kotaku|

#bb-rifle #bully #exploit

technology5 months ago•4 min saved

Rogue researcher releases second Windows Defender exploit, threatens more RCEs

A rogue researcher, Nightmare-Eclipse, released a second Windows Defender privilege-escalation exploit (RedSun) after Microsoft patched the first CVE-2026-33825 vulnerability. The PoC allegedly lets unprivileged users gain SYSTEM privileges by abusing Defender to overwrite system files; the researcher warns of more remote code execution exploits to come. Microsoft patched the flaw on Patch Tuesday and credited Zen Dodd and Yuanpei Xu, while the researcher continues to air grievances and threaten further disclosures.

via Cybernews|

#exploit #microsoft #privilege-escalation

security5 months ago•3 min saved

Adobe patches Acrobat/Reader zero-day exploited through PDFs

Adobe has issued an emergency security update for Acrobat and Reader to fix CVE-2026-34621, a zero-day that allowed malicious PDFs to bypass sandboxing and run privileged JavaScript, enabling arbitrary file reading and data exfiltration; the flaw was observed in the wild, linked to Russian-language oil-and-gas documents, with affected products including Acrobat DC, Acrobat Reader DC, and Acrobat 2024; Adobe downgraded the severity from 9.6 to 8.6 after changing the attack vector to local, and users should update via Help > Check for Updates or the official installer; exercise caution with PDFs from unknown sources and consider sandboxing suspicious files.

via BleepingComputer|

#adobe #exploit #pdf

technology6 months ago•4 min saved

DarkSword Goes Public: iPhone Data-Stealing Exploit Released

DarkSword, a web-based iPhone exploit, has been released on GitHub and is reportedly used by Russia-linked groups to compromise iPhones simply by visiting a compromised site; it targets iOS versions 18.4–18.6.2, exfiltrates data quickly, and does not require malware installation. Lookout and iVerify link it to the same infrastructure as earlier campaigns, with Google noting deployment by UNC6353 on Ukrainian government sites. Apple has issued a critical security update and urged users to update or enable Lockdown Mode; devices on older iOS versions should upgrade to newer releases (iOS 15 for 13/14).

via Mashable|

#cybersecurity #darksword #exploit

technology6 months ago•13 min saved

Slay The Spire 2 Clamps Down on 1B HP Glitch as It Tops 3 Million in Week One

Slay The Spire 2 sold 3 million copies and logged over 250 million runs in its first week of Early Access; Mega Crit Games is patching out a billion-HP exploit by capping HP at 999,999,999, while also planning balance tweaks, bug fixes, art updates, Steam Workshop support, multiplayer QoL improvements, and other features ahead.

via Kotaku|

#early-access #exploit #patch

technology7 months ago•1 min saved

Chrome patches two in-the-wild zero-days hit Skia and V8

Google released Chrome security updates to fix two high-severity zero-days exploited in the wild: CVE-2026-3909 (out-of-bounds write in Skia) and CVE-2026-3910 (V8 sandbox escape). Users should update to Chrome 146.0.7680.75/76 on Windows/macOS and 146.0.7680.75 on Linux; CISA added these flaws to the KEV catalog with a March 27, 2026 deadline for federal agencies.

via The Hacker News|

#chrome #exploit #security