Project
Microsoft's Chromium-based web browser bundled with Windows, featuring built-in AI tools, extension support, and enterprise management capabilities.
Mozilla announced Firefox Enterprise on October 12 without a price for its self-hosted management console. A DEV Community review says its AI lockdown already works in free Firefox through the AIControls policy.
Reality
Microsoft says attackers chained V8 Maglev code-execution bugs with V8 sandbox escapes against Edge and Chrome users who lacked the fixes. Chrome Stable's matching update arrived four days after Edge's, on 8 September.
Reality
Mozilla counts six Windows and Copilot behaviors that still override users' browser choice, 100 days after its Over The Edge 2.0 report. By Mozilla's own tests, the EU's Digital Markets Act fixed part of that in Europe and did not reach the newest surfaces.
Reality
Shopify added WebMCP checkout tools on September 28 that update payment and place an order once the buyer confirms. The spec is still a draft with no Firefox or Safari implementation, so tools belong on the open session behind a review step.
Reality
Graz University of Technology researchers used file-change alerts to catch 95.7% of another Windows user's Firefox site visits from an unprivileged account. On shared hosts and on servers that run services under their own accounts, separation between users is weaker than the account model suggests.
Reality
In Cloudflare's lab test, RFC 9842 dictionary compression sent a 272 KB JavaScript file as a 2.6 KB delta, where gzip produced 92.2 KB. Teams that deploy small fixes often can now send returning visitors the change, where today those visitors download the whole bundle again.
Reality
Ontinue says the Python implant takes tasking from SharePoint dead drops over Graph API, relays interactive sessions through Teams TURN, and moves all of it through the victim's own headless Edge.
Reality
The new backdoor, HOOKEDGE, is a Windows batch script that beacons to a free webhook.site endpoint. Insikt Group calls the BlueDelta attribution moderate confidence, resting on overlap with the older HEADLACE implant.
Perspective Coverage
3 publishersReality
Socket found 19 Chrome and Edge extensions carrying crypto-draining code, five of them bought from their original owners. The malware landed in updates after each listing had earned real installs, which is exactly what a one-time vetting pass never re-checks.
Reality
Opera asked judges in Luxembourg to force Microsoft Edge under the Digital Markets Act and lost, which tells platform teams that crossing the user thresholds only opens a market investigation the gateway argument can still close.
Reality
SOCRadar says the toolkit needs administrative or code execution access first, then writes itself into Chrome and Edge profiles with integrity values the browser accepts and bridges to a native host binary that runs shell commands.
Reality
RoamProxy's extension mints a new proxy hostname on every save because Firefox and Edge kept reusing connections authenticated with the old username. Any gateway that routes by username on one host and port hits the same silent failure.
Reality
Graz University of Technology researchers used OS file-change alerts to identify sites another Windows user visited with 97.8% accuracy in Firefox. Every attack needs code already running on the device; on Android, an app that asks for no permissions is enough.
Reality
Gal Weizman showed that one malicious extension can take over the AI agents in Chrome, Comet, Edge, Neon and Claude in Chrome, with bounties from all five vendors to show for it. Installation is the only precondition.
Perspective Coverage
3 publishersReality
getImageData can only ever read pixels your own code painted, and the screen-capture workaround reaches the rest of the display only with a permission prompt and a recording banner. Chromium has shipped window.EyeDropper since late 2021.
Reality
Dashlane's answer to employees drifting back to typed passwords is a per-domain block inside the browser extension. The work that decides whether it helps happens upstream, when an admin picks which login pages go on the list.
Reality
Elastic Security Labs describes a Brazilian banking operation that edits a Chrome or Edge profile and then signs its own edit using the OSCrypt and App-Bound keys sitting on the same machine. The browser loads the extension as approved.
Reality
Microsoft rated 114 of the 973 Critical, but 284 score 8.0 or higher and two Important-severity Windows bugs are already under attack. One 9.1 advisory in the same cycle came from outside Microsoft.
Reality
Elastic Security Labs tied 1,515 infections, almost all in Brazil, to a loader that waits for Chrome to close and then writes its own extension into the profile directory with integrity hashes the browser accepts.
Reality
Forever Security showed the same technique working against Gemini in Chrome, Comet, Edge, Opera Neon and the Claude extension. Google and Microsoft have shipped fixes; the other three findings rest on the researchers' own account.
Reality
Invest · August 20, 2026 · Confirmed2 publishers