New Chrome Vulnerability Let Malicious Extensions Escalate Privileges via Gemini Panel
2026-03-04T23:31:11Z•29083e34fe7134137587a35a2d7f69d9842c49297c099df3d4b62381943ff597
CVE-2025-40538CVE-2026-0628CVE-2026-20127CVE-2026-21513CVE-2026-25108APT28active-exploitationaeternum-c2browser-securitychromecisco-sd-wanexploitationfilezenfreepbxgeminigo-modulegoogle-cloud-api-keysmalwaremshtmlnpmnugetpqcquantum-resistant-certificatesrekoobesupply-chain
What happened
The feed reports a wave of high-impact security incidents and supply-chain abuse across browsers, cloud services, networking gear, OSS package ecosystems, and AI tooling. Notable vulnerabilities include a Chrome WebView privilege escalation (CVE-2026-0628), an MSHTML bypass linked to APT28 (CVE-2026-21513), a widely exploited Cisco SD‑WAN zero-day with a CVSS 10.0 bypass (CVE-2026-20127), and a FileZen command‑injection now in CISA’s KEV (CVE-2026-25108). Researchers also disclosed malicious packages (npm, NuGet, Go), a trojanized Go crypto module delivering the Rekoobe backdoor, thousands of泄
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- the_hacker_news
- Record identifier
- 29083e34fe7134137587a35a2d7f69d9842c49297c099df3d4b62381943ff597
- Enrichment time
- 2026-03-04T23:31:11Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.