Chrome DevTools use-after-free enables sandbox escape

🕵️ RESEARCH & DEEP DIVES

• AWS publishes incident response guide for CloudTrail investigations – Part 1
  AWS has published a guide walking through how to investigate security incidents using AWS CloudTrail logs.

  • Applies to AWS customers and security teams investigating suspicious activity in their AWS environments
  • The guide explains which CloudTrail log fields matter and how to interpret them when investigating incidents
  • Part 1 walks through real-world scenarios showing how to analyze CloudTrail events to uncover the full scope of an incident
    📎 Coverage: aws.amazon.com · 👁 via AWS Security Blog

• Coder's registry infrastructure compromised to push malicious modules — BleepingComputer

• Large Enterprises Targeted in Fake Merger & Acquisition Scams — Dark Reading

• What We Missed: Did ShinyHunters 'Breach' ReliaQuest? — Dark Reading

• ThreatsDay: CEO Phishing Kits, 5K Dropbox Account Hacks, OAuth Traps + 17 More Stories — The Hacker News

• The G7 tells industry to hurry up and prep for post-quantum encryption — CyberScoop

• The story behind the intelligence — Cisco Talos

• Divide-by-zero in Xpdf 4.06 due to zero-height Type 3 glyphDivide-by-zero in ... — CVE ThreatInt

• MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap ... — CVE ThreatInt

• stream-json: pick/ignore/filter/replace filters are O(depth2) on nested input... — CVE ThreatInt

• Qiskit SDK is vulnerable when deserializing QPY Files and may overflow the av... — CVE ThreatInt

• Use of released resource in Mobile in Google Chrome on on Android prior to 15... — CVE ThreatInt

• Improper input validation in Transactions Platform in Google Chrome on on iOS... — CVE ThreatInt

• Type confusion in Compositing in Google Chrome prior to 152.0.7977.82 allowed... — CVE ThreatInt

• Improper resource exposure in CacheStorage in Google Chrome prior to 152.0.79... — CVE ThreatInt

• Out of bounds write in WebGL in Google Chrome on on Android prior to 152.0.79... — CVE ThreatInt

• Race condition in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote... — CVE ThreatInt

• Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed... — CVE ThreatInt

• Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote... — CVE ThreatInt

• R2R 3.6.6 SQL Injection via Retrieval Search Filter KeyR2R through 3.6.6 cont... — CVE ThreatInt

• itsourcecode Online Medicine Delivery System index.php cross site scriptingA ... — CVE ThreatInt

• Medplum - Exposure of OAuth client secret via dynamic registration endpoint i... — CVE ThreatInt

• Incident response guide for AWS CloudTrail investigations – Part 2 — AWS Security Blog

• Introducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak models — Cloudflare Blog

• @ jpsays Any insights on same subnet RDP inbound 3389 to a desktop listening for TermServ would not respond to SYN, and... — @SwiftOnSecurity@infosec.exchange

• python-jose HS256 Token Forgery (CVE-2026-85394) — thehackerwire.com (discovered)

• GeoNetwork Critical RCE via XSLT Processor Misconfiguration (CVE-2026-58400) — thehackerwire.com (discovered)

• Bankrupting the Adversary: Why Cybersecurity is an Economic War — securityboulevard.com (discovered)

• Millions of US/Canadian drivers license being sold - Who do we think got breached? Id.me? Verify.me? — r/cybersecurity

• Breaking Down Appsec Part 1: Application Context — r/cybersecurity

• newbie question here about cyber security and the future — r/cybersecurity

• Network pentesters with 2–3 years of experience: What does your day-to-day work actually look like? — r/cybersecurity

📋 ADVISORIES

• 📄 Source for Chrome DevTools use-after-free (CVE-2026-85042) allows sandbox-escape code execution, fixed in 152.0.7977.82 — chromereleases.googleblog.com