grep -rl "chrome" ./articles
Proofpoint disclosed BlueMoon on 9 September: a kit chaining a Chrome V8 flaw, a sandbox escape with no CVE at all, and a Windows ALPC bug. APT31 used it first on 28 August. Three more espionage clusters were running it within days. The chain is not the story. The distribution is.
SOCRadar documented a post-exploitation toolkit that installs itself into Chrome and Edge profiles as an extension called Smart Bookmarks, forges the signatures Chromium uses to detect exactly that, and reaches the operating system through native messaging. It cannot get onto a machine by itself, which is the part the headlines drop.
CVE-2026-85046 is a V8 type confusion, rated 8.8, exploited in the wild, and the sixth actively exploited Chrome zero-day of 2026. It was reported on 4 August and awarded $1,000 — an amount that does not appear anywhere on Chrome's published memory-corruption reward schedule. Several explanations fit. Google has offered none.
Socket found 19 Chrome and Edge extensions draining wallets, harvesting hardware wallet seed phrases and stealing credentials. The operators wrote 14 of them and purchased the other five from previous owners — complete with existing users. Then they pushed an update, and Chrome installed it automatically.
Google published Q1 2026 figures for its notification abuse work: automatic permission revocation for inactive sites, HTTP 429s past a threshold, and network-level analysis of coordinated service workers.
'AI Sidebar with DeepSeek, ChatGPT, Claude and more' had 300,000 installs and a 4.6-star rating before Google removed it in January. It returned in August, clean for eleven days, then shipped a 21-line addition.