Threats
Vulnerabilities and patches
Breaches and privacy
Research
World
Learn
Monday 2 November
Global

Your region, kept on this device.

Get the appSign in

Chrome

Product · by Google

Vulnerabilities

79 CVEs in our records, 0 known exploited (on CISA's KEV list).

16Critical
57High
6Medium
0Low
0No score
Source: NVD and CISA KEV

Am I affected?

Checked against NVD affected-version data on our server. Nothing you type is stored.

Affected versions

Source: NVD

Security timeline

  1. Malware reported by Malwarebytes Labs319 Chrome extensions with 13.4 million installs hijacked users' search settings and routed queries via operator servers
  2. Malware reported by Cyber Security NewsNIK C2 malware abuses OpenAI API for credential theft and remote control
  3. Vulnerability reported by Cyber Security NewsAnthropic says its AI model built a working root exploit for critical Linux kernel flaw CVE-2026-98432

Recent news

Help Net Security·

Byoky: open-source wallet keeps AI API keys encrypted on the user's device

Byoky is an open-source wallet for AI API keys from OpenAI, , Google Gemini and other providers, available as and Firefox extensions and as iOS and apps. Keys are encrypted on the user's device, and the wallet sends provider requests on behalf of apps, which receive only a session token while the key stays in the wallet.

Am I affected?
Ask
1
Cyber Security News· · High

VOLTA infostealer uses a commercial AI model to profile victims after stealing their sessions

published details on 31 October 2026 of VOLTA, a Windows infostealer that takes browser credentials, cookies and tokens for Gmail, , Slack, Steam, Telegram and others. It uses the victim's Gmail session to find order receipts and confirm home addresses, then sends a summary file to OpenRouter, defaulting to Claude Opus 4.6 with fallbacks to Kimi K2 and Gemini 2.5 Flash, to produce a ranked victim assessment. Talos believes VOLTA is sold as a builder and did not confirm whether it has been used in the wild.

Am I affected?
Ask
1
SecurityWeek·

Google unveils Gemini 4 Carbon AI model with advanced cybersecurity capabilities

has unveiled Gemini 4 Carbon, which it says performs strongly on vulnerability discovery (88.2% on SEC-bench Pro), exploitation (54.8% on ExploitGym) and patching (71.0% on CWE-bench). Access will start with vetted defenders through the Fairwind Program, with no firm date for general availability, and the benchmarks were run without guardrails.

Am I affected?
Ask
2
Malwarebytes Labs·

319 Chrome extensions with 13.4 million installs hijacked users' search settings and routed queries via operator servers

Socket researcher John Tuckner identified 319 extensions, with an estimated 13.4 million installs over a decade, that hijacked default search settings and proxied queries through operator-controlled servers before forwarding them to Yahoo or Bing. The operators could read queries, which were often tied to a unique identifier, and earned referral payments. The extensions were promoted through ads on networks including Ads and were listed in the official store, mostly as unlisted entries reachable only by direct link.

Am I affected?
Ask
1
Cyber Security News· · High

NIK C2 malware abuses OpenAI API for credential theft and remote control

NIK C2 is a Go-based Windows remote access implant that communicates over TLS WebSockets on port 443 with an HTTP backup channel, using AES-256-GCM encryption and rotating across three server tiers. Its aigenerate command sends attacker prompts to the OpenAI Chat Completions endpoint from the victim's machine, and if no API key is supplied it falls back to the victim's OPENAIAPIKEY environment variable. , which published its findings, reports credential and crypto-wallet theft, a keylogger, hidden VNC, and a screen-locking ransomware module that does not encrypt files.

Am I affected?
Ask
1
Cyber Security News· · Critical

Anthropic says its AI model built a working root exploit for critical Linux kernel flaw CVE-2026-98432

says an unreleased Claude research model produced a zero-click exploit for CVE-2026-98432, a use-after-free race condition in the Linux kernel's IPv4 TCP handling that gives unauthenticated root command execution, with a claimed 9.8 CVSS score. Upstream fixes are available in stable branches such as 5.10.272, 5.15.223 and 6.6.159, but distribution fixes are uneven, with Ubuntu and Red Hat Enterprise Linux reportedly lacking patched kernels as of 30 October. Teams should prioritise internet-facing servers, apply vendor kernel updates, reboot, and check whether multipath TCP listeners are needed.

Am I affected?
Ask
6