A technical walkthrough of a new offensive technique that activates the Chrome Debugging Protocol directly in memory, bypassing Google's --remote-debugging-port mitigations. Covers chrome.dll signature scanning, DevToolsSocketFactory vtable reconstruction, PartitionAlloc constraints, and Special APC-based shellcode injection into the Chrome parent process.

Browser extensions are an underestimated attack surface. They run natively in the browser, are trusted by design, have access to cookies, network requests, and every page the user visits - and most EDRs don’t even look at them. In a post-exploitation context, a malicious extension operating as an agent is practically invisible to standard endpoint security tooling.

A crafted manus:// Deep Link could replace the token used by Manus My Computer, reconnect the desktop app, and lead to remote code execution through its sidecar.

Sansec found a Magecart family that runs its skimmer straight out of Stripe. The attacker stores the card stealer in a Stripe customer's metadata and runs it...

Learn how you can easily determine the Screen refresh rate with the help of a little trick in the browser with JavaScript

TL;DR In April 2026, Adobe disclosed three critical security issues (CVE-2026-34621,CVE-2026-34622,CVE-2026-34626) affecting Acrobat DC, Acrobat Reader DC, and Acrobat 2024. According to Adobe’s advisories, these vulnerabilities could allow attackers to execute arbitrary code and leak user information through a malicious PDF file via a prototype pollution chain and they were reportedly exploited in the wild. The initial issue, CVE-2026-34621, was first identified by EXPMON. While several reports have already covered the threat intelligence and malware-analysis aspects of the ITW samples, we were more interested in the underlying vulnerabilities themselves and how Adobe patched them.

A prototype pollution bug in Figma’s variant counter, chained through a plugin-context race against $INTERNAL_DO_NOT_USE$RERUN_PLUGIN$, a jsx_debugging feature-flag flip, and a forgotten writeFileToPath IPC in the Electron desktop app, to achieve zero-click cross-platform RCE from a published plugin. Reported to Figma and patched within hours.

Vulnerability intelligence that predicts avenues of attack with speed and accuracy.

Executive Summary The EXPMON system detected a highly-sophisticated PDF exploit targeting Adobe Reader users. Based on our analysis, the sam...

How I Found a 0-Day in an Electron App’s Email Viewer Most people think 0-days are found in glamorous places: cryptography, kernel code, browser internals, or some deeply obfuscated subsystem that …

Hardcoded credentials, pointless encryption, and generous APIs exposed details of every employee and made it possible to break into internal websites.

Introduction Meta’s web ecosystem relies on cross-window messaging between first-party websites. In many cases, the only security control enforced is an origin check validating that messages originate from facebook.com or its subdomains.

Beneath the surface, the modern web is made possible only through a growing labryinth of technology standards. Standards are designed to govern the interoper...

Author(s): Vlad Pasca, Radu-Emanuel Chiscariu Sophisticated cybercriminal operation targets cryptocurrency users and Web3 employees Malwa...

Web site created using create-react-app

ClickFix Hunter - A public repository of malicious ClickFix domains.

This book will highlight the ins and outs of the HTML parser, and contains almost-impossible quizzes.

Chrome V8 Type Confusion Zero-Day: CVE-2025-10585 - Detailed Code Analysis and Visual Examination

In this post, I will introduce the "cookie sandwich" technique which lets you bypass the HttpOnly flag on certain servers. This research follows on from Bypassing WAFs with the phantom $Version cookie

JP (Translated by ChatGPT) In this article, I'll explain the intended solution for the "Tanuki Udon" challenge presented in SECCON CTF 13. TL;DR An XS-Leaks attack using Speculation Rules can be performed when the following conditions are met: The attacker can inject Speculation Rules into the victi…

Exploring the DOMPurify library: Hunting for Misconfigurations (2/2)

Disclaimer: This article is intended for security professionals conducting authorized testing within the scope of a contract. The author is not responsible for any damage caused by the application of the provided information. The distribution of malicious programs, disruption of system operation, and violation of the confidentiality of correspondence are pursued by law. Introduction Many security researchers are familiar with the frustrating experience of discovering an XSS vulnerability that requires complex actions within an account, effectively making it only reproducible on the attacker’s account and thus losing its practical value.

A behind-the-scenes look at HelloTDS: the stealthy infrastructure driving FakeCaptcha scams, malware and more across millions of devices