Topic
Chromium
AI Agents Codex and Grok Generate Passing Tests That Fail to Verify Cookie Signatures and Security Logic
AI Security
Google Chrome Prepares Deferred Restart Feature to Apply Security Updates Without Disruption
Vulnerabilities & Exploits
CVE-2026-85046 Exploited in Chromium V8 Engine, Affecting Chrome, Edge and Other Browsers
Vulnerabilities & ExploitsAmnesiaStealer Malware for macOS Hijacks Authenticated Browser Sessions via ClickFix and Chromium
A new macOS malware strain named AmnesiaStealer has emerged that combines infostealing, persistence mechanisms, and the ability to silently take over already authenticated browser sessions. The infection chain begins with a fake GitHub page that tricks victims into copying a malicious command into Terminal using the ClickFix social engineering technique. Once executed, the Rust-based payload collects system data, displays a fake installer window to capture the user password, and attempts to unlock the Keychain for protected credentials. Targeted data includes browser cookies, history, extensions, documents, Apple Notes, Telegram sessions, and cryptocurrency wallet information. A secondary module copies the browser profile and launches a hidden Chromium instance controlled through the Chrome DevTools Protocol, allowing attackers to interact with active sessions that have already passed multi-factor authentication. Persistence is achieved via a disguised LaunchDaemon, and the malware attempts to remove installation artifacts afterward.
Ruthenium: Custom Chromium Build for Android Adds Russian Trusted Root CA Support
A developer has released Ruthenium, a modified Chromium browser for Android that embeds the Russian Trusted Root CA certificate issued by the Ministry of Digital Development. The build restricts trust to .ru and .рф domains only, avoiding changes to the system-wide Android certificate store. The project patches four Chromium source files to include the root with DNS constraints via CertWithConstraints, disables Google sign-in by default, and removes XR-related code for successful compilation. Ruthenium uses the official Chromium TLS verification logic without introducing a custom verifier. The APK is distributed with SHA-256 checksums, build metadata, and reproducible release tags tied to the exact Chromium revision and certificate digest. Users can install it alongside stock Chrome and use it selectively for Russian government and banking sites that rely on the state root.
Building a Minimalist UI Test Framework with Playwright and Pytest
Vladislav Timashenkov from InfoWatch presents a practical approach to constructing a concise UI automation testing framework using Playwright. The article focuses on leveraging native Playwright features instead of creating additional abstraction layers. It covers launching a Chromium browser once per session, handling authentication via API calls to obtain cookies, and managing isolated BrowserContext instances for test independence. Readers learn how to implement Page Object models that rely on Playwright's built-in locators and auto-waiting mechanisms. The tutorial includes real code examples for fixtures, context factories, and a sample test for tag management functionality. This method reduces maintenance overhead while ensuring tests remain scalable across different environments.
Dangerous C++ Traps: Memory Safety Issues, Undefined Behavior, and Code That Betrays Developers
Around 70% of vulnerabilities assigned CVE numbers by Microsoft each year stem from memory safety errors, with Chromium reporting a similar pattern for serious Chrome bugs. The article examines how C++ deliberately permits low-level memory access for performance but demands strict discipline to avoid undefined behavior (UB). It details real-world cases including Heartbleed (CVE-2014-0160) in OpenSSL, use-after-free errors, buffer overflows, and data races. Modern tools such as AddressSanitizer, UndefinedBehaviorSanitizer, and ThreadSanitizer are presented as essential for detection, alongside recommendations for RAII, std::span, and smart pointers. The piece also discusses C++26 changes introducing erroneous behavior for uninitialized variables and advises when to consider memory-safe languages like Rust for new components. Practical migration steps and compiler warning strategies are outlined to reduce risk in existing codebases.
Dolphin X Malware Adds AI Profiler to Rank and Prioritize High-Value Victims After Infection
Dolphin X is a newly identified Windows infostealer and remote access trojan that integrates an AI Profiler component designed to score infected machines and generate priority rankings for operators. The profiler analyzes telemetry from compromised systems, including application usage, browser domains visited, and installed software, to produce daily summaries that help attackers focus resources on the most valuable targets such as those with cloud access or sensitive tools. Dolphin X claims compatibility with over 300 applications, explicitly covering nine Chromium and Gecko browser families, more than 100 cryptocurrency wallet extensions, 65 desktop wallets, 10 password managers, and over 30 common cloud CLI tools. The malware targets files like .env configurations, SSH keys, cloud access tokens, browser sessions, and cryptocurrency wallet data to accelerate movement from initial credential theft to further compromises in accounts and production environments. Researchers have confirmed the AI Profiler workflow and associated scoring functions in the operator panel, although the underlying AI model itself remains unverified without full analysis of an active sample. The discovery highlights how automated prioritization can significantly shorten the time between mass infections and targeted follow-on attacks, prompting recommendations for reduced local credential storage and enhanced behavioral detection.