Skip to content
Threat Feed
Subscribe

Tag

Chrome-Extension

2 briefs RSS
critical advisory

SiYuan Unauthenticated Admin API Access via Chrome Extension Allowlist

A critical vulnerability (CVE-2026-54069) in SiYuan Note kernel's HTTP server allows any Chrome/Chromium browser extension to gain unauthenticated RoleAdministrator access, enabling data exfiltration, stored XSS injection, and configuration tampering for SiYuan desktop users, including via compromised legitimate extensions.

SiYuan Note +1 web-vulnerability privilege-escalation data-exfiltration xss supply-chain desktop-application chrome-extension siyuan
1r 6t 1c 1i
high advisory

Malicious Chrome Extensions Stealing Data and Opening Backdoors

A coordinated campaign uses 108 malicious Chrome extensions to steal user data, inject ads, and establish backdoors on over 20,000 systems via a shared command-and-control infrastructure.

chrome-extension credential-theft backdoor ad-injection exfiltration
2r 6t