Taming Agentic Browsers: Vulnerability in Chrome Allowed Extensions to Hijack New Gemini Panel
2026-03-04T21:27:31Z•c2350cf7ecdec0a3d882894f5a38655757b454d37559733a89e9aae829cca459
CVE-2025-0921CVE-2026-0628CVE-2026-1281CVE-2026-1340CVE-2026-1731azure-dosbackdoorbeyondtrustchrome-geminicloud-detectionextension-hijackivanti-epmmlocal-file-accessmuddled-libranotepadplusplusot-securityqr-phishingrcescadasupply-chainwebshellzero-day
What happened
Unit 42 published multiple security briefings covering high‑impact vulnerabilities and attacker activity. Notable disclosures include a high‑severity Chrome Gemini extension hijack (CVE‑2026‑0628) that allowed local file access and privacy invasion (patched by Google); a critical BeyondTrust RCE (CVE‑2026‑1731) exploited to deploy VShell and SparkRAT; exploited Ivanti EPMM zero‑days (CVE‑2026‑1281 and CVE‑2026‑1340) used to drop web shells and backdoors; and a privileged file system DoS in Iconics SCADA (CVE‑2025‑0921). Unit 42 also reported on related operational tradecraft and trends: Notpad
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- paloalto_unit42
- Record identifier
- c2350cf7ecdec0a3d882894f5a38655757b454d37559733a89e9aae829cca459
- Enrichment time
- 2026-03-04T21:27:31Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.