VoidStealer malware steals Chrome master key via debugger trick

A batch of high-impact security stories: a new information stealer called VoidStealer uses a debugger-based trick to bypass Chrome’s Application-Bound Encryption and extract the browser master key; the Trivy vulnerability scanner was abused in a supply-chain compromise (via GitHub Actions) to distribute credential-stealing malware attributed to TeamPCP; and Google announced an ‘Advanced Flow’ to make APK sideloading safer for power users. Multiple high-severity vulnerabilities and incidents were reported—Oracle issued an out-of-band patch for a critical unauthenticated RCE in Identity Manager,