← All stories

Vulnerabilities

Google Hardens Chrome Against ClickFix Attacks and Insecure HTTP Connections

By SecurityWeek1 min read

Google has added new protections to Chrome aimed at scams and social engineering, including defenses against ClickFix-style attacks and insecure HTTP connections, according to SecurityWeek. The measures reportedly include new site warnings and server-side analysis powered by Gemini.

Cover for a vulnerabilities story

Google has rolled out new protections in its Chrome browser designed to blunt scams and social engineering attacks, including the increasingly common technique known as ClickFix, SecurityWeek reported.

According to the report, the hardening effort targets two areas in particular: ClickFix-style attacks and insecure HTTP connections. ClickFix is a social engineering tactic in which victims are lured into copying and running malicious commands themselves, often through fake error messages, bogus CAPTCHA checks or fraudulent "fix it" instructions presented on compromised or malicious websites. Because the user performs the action, such attacks can sidestep some traditional security controls.

The new Chrome defenses include fresh site warnings intended to alert users before they interact with potentially dangerous pages, SecurityWeek said. Google is also employing server-side analysis powered by its Gemini AI technology to help identify deceptive or malicious content, the report said.

The move reflects a broader industry push to address threats that exploit user behavior rather than software flaws. Browser vendors have increasingly turned to a mix of on-device warnings and cloud-based analysis to flag scam pages and risky connections in near real time.

Details of the changes come from SecurityWeek's report. Google had not publicly elaborated on rollout timing or the full scope of the protections at the time of the report.

Source: SecurityWeek

Cover for a vulnerabilities story

Vulnerabilities

Brotli Compression Bug (CVE-2026-111497) Reaches Far Beyond Node.js

A remotely exploitable out-of-bounds write flaw in Google's widely used Brotli compression library, publicly disclosed by Node.js on October 21, 2026, affects software well beyond the Node.js ecosystem, Help Net Security reported. Attackers who can get an application to decompress crafted Brotli data via node:zlib can corrupt process memory, potentially causing crashes or memory disclosure.

1 min read

AI-written summary Source: Help Net Security · Fetched

Cover for a vulnerabilities story

Vulnerabilities

Hackers Flood Inboxes With Spam, Then Pose as IT Support on Microsoft Teams

Attackers are flooding employees' inboxes with spam and then contacting them on Microsoft Teams posing as IT help desk staff, offering to fix the very problem they created. Arctic Wolf documented more than 400 incidents involving abuse of the Teams external chat feature, Help Net Security reports.

1 min read

AI-written summary Source: Help Net Security · Fetched

How to read this

Authorized-only · evidence-based · point-in-time. Aegis cannot guarantee the absence of weaknesses or hidden devices. On this machine, live external HTTP/TLS may be network-blocked and shown as an honest coverage gap. Severity and confidence are kept separate. Finished assessments persist in the encrypted store while durable storage is bound. A theme choice may persist in this browser. Export remains available for a copy you can take with you.