Today's outlook

Six critical Chrome flaws fixed at 9.6; supply-chain and sandbox-escape research fills out the day

By The IT Security Desk

Good morning. Google's advisory lists six Chrome vulnerabilities — CVE-2026-91738, CVE-2026-91729, CVE-2026-91728, CVE-2026-91718, CVE-2026-91716 and CVE-2026-91710 — each carrying the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H and a base score of 9.6. The vector describes a network-reachable flaw that needs no privileges but does require user interaction, and that crosses a scope boundary with high impact to confidentiality, integrity and availability. Google's advisory lists Chrome versions up to the fix in 153.0.8010.47 as affected. None of the six is on CISA's KEV catalog. What to do: apply the fixed Chrome release, 153.0.8010.47, across your estate, and follow Google's advisory for any interim mitigation.

BleepingComputer reported an ongoing npm malware campaign involving the 'indexed-btree' package, and says the threat actors bypass supply-chain defenses by hiding malicious code in the package's normal runtime behavior rather than in installation scripts — meaning install-script scanning alone does not catch it. Review dependency trees for 'indexed-btree' and treat runtime behavior, not just install hooks, as part of your package vetting.

BleepingComputer also reported that researchers escaped OpenAI's Codex sandbox in two ways, one of them running commands on a developer's machine from Codex's most locked-down mode, and states OpenAI has patched both.

Help Net Security's week-in-review recaps two incidents. Cisco patched an exploited email gateway zero-day, per Help Net Security. On Revolut, Help Net Security says someone impersonating a government agency, using an email address on that agency's domain, obtained sensitive customer records, and that the bank confirmed the incident.

The Record reported that Russian officials claimed thousands of cyberattacks on election infrastructure during the vote. The Record states those claims could not be independently verified and that Russian officials provided little technical evidence about the attacks or who they claimed was behind them.