buildConfirmed6 publishers Mozilla launched Firefox Enterprise on October 12, 2026, with a browser management console that customers run on their own infrastructure. Policy, DLP and AI-use controls live on that server, so the customer also deploys, patches and backs it up.
Perspective Coverage
6 publishers
- Builder
- Builder 16%
- Operator
- Operator 51%
- Investor
- Investor 33%
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+15
- Incentives65
- Confidence70
Attackers chain V8 Maglev bugs with sandbox escapes against Edge and Chrome builds missing the fix
Microsoft says attackers chained V8 Maglev code-execution bugs with V8 sandbox escapes against Edge and Chrome users who lacked the fixes. Chrome Stable's matching update arrived four days after Edge's, on 8 September.
Publishers:microsoftedge.github.io
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+15
- Incentives60
- Confidence55
buildOne report1 publisher Portrait MP4 frames decoded with WebCodecs come out sideways in all four tested browsers
Portrait MP4 clips decoded with mp4box.js and VideoDecoder came out 1920x1080 and sideways in Chromium, Chrome, Firefox and WebKit, a dev.to post reports. The rotation lives in the track header matrix that the demuxer exposes, so the app has to read it and turn the canvas itself.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence58
Researchers at haveibeensquatted.com found three Cyrillic letters that still break Chromium's whole-script lookalike check in current Chrome. A name built on one can display close to a real brand, so the address bar is a weaker check than users are taught.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence62
buildOne report1 publisher CSS anchor positioning hands dropdown placement from Floating UI to the browser
CSS anchor positioning reached Baseline in September 2026, so current releases of every major browser can tether a dropdown to its trigger in CSS alone. Teams can retire Floating UI from simple dropdowns now if they plan what users on older browser versions will see.
Reality
- Evidence50
- Adoption25
- Hype gap+20
- Incentives70
- Confidence50
buildOne report1 publisher A 124-color PNG-8 beat every JPEG export of a red-text poster on size and edge error
PNG-8 at 124 colors encoded a red-text test poster in 48,481 bytes at an edge error of 0.13 Delta E, smaller and cleaner than every JPEG export. For flat graphics like this one, an export tool that converts everything to JPEG ships bigger files with dirtier red text.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+5
- Incentives55
- Confidence60
buildOne report1 publisher Two known-exploited Chromium V8 bugs lead September's 36 device CVEs beyond the kernel
TECH VEDA counts 36 actionable device CVEs across 14 non-kernel packages in September, two of them Chromium V8 bugs on CISA's exploited list. How many apply to a given fleet depends on each image's SBOM and on which scorer a team trusts.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence50
buildOne report1 publisher Synthetic clicks pass a covered Angular button in jsdom and headless Chromium alike
Engineers testing six Angular scenarios found user-event clicks passed a button covered by a decorative layer, even in headless Chromium. Only a Playwright provider click or a separate elementFromPoint hit test caught it.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap−5
- Incentives
- Not scored
- Confidence50
buildOne report1 publisher Raising canvas JPEG quality to 0.99 leaves red text fringed in Chromium
Chromium 149 canvas JPEGs grew 2.25x from quality 0.80 to 0.99 while red-text edge error fell only from 8.11 to 6.35, one developer measured. Firefox drops chroma subsampling at a lower setting, so the reviewer's browser decides whether the fringe shows.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap0
- Incentives
- Not scored
- Confidence55
buildOne report1 publisher A million-row CSV sort ran 140x slower in Electron's renderer than the same code in Node
Sorting a million-row CSV in an Electron renderer took over a minute, 140x slower than the same code in a Node script, its developer found. The slowdown showed up only in a renderer already holding a large file, so a profile taken there was the only way to find it.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence40
Git 2.56 ships its conflict-marker check as a flag that scripts and agents must opt into
Git 2.56 adds a staging flag that aborts on leftover conflict markers and cuts one Chromium diff from about eight minutes to 0.07 seconds. Teams get the speed by upgrading, but they get the safety only by editing the scripts their developers and coding agents run.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+10
- Incentives30
- Confidence62
buildOne report1 publisher Chrome 152 again exempts google.com from its delete-site-data-on-close setting
Chrome 152 keeps google.com's cookies and storage after 'delete on close' is switched on, developer Jeff Johnson found. Google fixed a similar exemption in 2020, and the same behaviour in open-source Chromium means other browsers and test rigs need their own check.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence50
OpenSourceMalware flagged the campaign on August 15, 2026. The install hook fakes a clean native build while pulling a Windows stealer that goes after browser credentials and crypto wallets.
Reality
- Evidence72
- Adoption15
- Hype gap+10
- Incentives40
- Confidence70
Abnormal says iAuthFlow v2 uses a phished Google session to register an operator-controlled passkey. The standard playbook of revoking sessions and resetting the password does not remove it.
Perspective Coverage
3 publishers
- Builder
- Builder 32%
- Operator
- Operator 60%
- Investor
- Investor 8%
Reality
- Evidence52
- Adoption15
- Hype gap+12
- Incentives55
- Confidence58
PEEP forges Chromium's Secure Preferences to plant a command-execution extension in Chrome and Edge
SOCRadar says the toolkit needs administrative or code execution access first, then writes itself into Chrome and Edge profiles with integrity values the browser accepts and bridges to a native host binary that runs shell commands.
Reality
- Evidence58
- Adoption10
- Hype gap+12
- Incentives
- Not scored
- Confidence55
CVE-2026-87491 gives a crafted web page code execution inside Chrome's sandbox. The fix only takes effect when the browser restarts, and long-running sessions carry that exposure until they do.
Perspective Coverage
5 publishers
- Builder
- Builder 14%
- Operator
- Operator 80%
- Investor
- Investor 6%
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap0
- Incentives30
- Confidence70
Proofpoint says at least four China-linked espionage groups fired the same BlueMoon code at different victims during the four weeks a Chromium fix took to reach stable Chrome, and two more groups probably did too.
Perspective Coverage
9 publishers
- Builder
- Builder 31%
- Operator
- Operator 60%
- Investor
- Investor 9%
Reality
- Evidence80
- Adoption30
- Hype gap+10
- Incentives40
- Confidence76
buildOne report1 publisher Firefox and Edge keep using a proxy's old username until its hostname changes
RoamProxy's extension mints a new proxy hostname on every save because Firefox and Edge kept reusing connections authenticated with the old username. Any gateway that routes by username on one host and port hits the same silent failure.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+10
- Incentives60
- Confidence50
Gen Digital found the chain while working a live UNC3569 intrusion. Tencent's April 2026 fix closed the link handler and left the bundled Chromium 80 in place, with its sandbox still switched off in the code.
Perspective Coverage
3 publishers
- Builder
- Builder 40%
- Operator
- Operator 50%
- Investor
- Investor 10%
Reality
- Evidence68
- Adoption72
- Hype gap+20
- Incentives40
- Confidence70
Volexity attributes September 1 spear-phishing at multiple NGOs to the Chinese cluster UTA0560. The chain used two Chrome flaws and one in Windows ALPC, and a second China-nexus actor ran the same chain.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence62