🕵️ RESEARCH & DEEP DIVES
- SelectorsHub Chrome extension (~400k users) opens server-picked ad tabs without user action
The SelectorsHub XPath extension has been found to open server-controlled ad URLs in background tabs without user interaction.- Affects users of the SelectorsHub Chrome extension (ID ndgimibanhlabgdgjcpbbndiehljcpfh), version 5.8.5, with roughly 400,000 users, popular with QA and test automation engineers.
- The extension fetches destination URLs from selectorshub[.]info at runtime and opens them in background tabs; on install and update, URLs open with no prompt or overlay.
- Side panel and DevTools paths show a 5-second overlay labeling the destination a 'community link' with '100% Safe, No Spam, No Malware' before opening it; destinations are paid ads controlled entirely by the developer's server and changed three times during testing without an extension update.
- The extension calls cookies.getAll({}), reading every browser cookie to find one of its own, and sends daily counter pings and ad-click tracking to shubads.testcasehub[.]net, which redirected to blomehairdryers[.]com, an Indonesian gambling site — despite the store listing claiming no user data is collected.
- A remote-code-integrity risk exists in the DevTools panel, where a server-returned 'fix' string can be passed to inspectedWindow.eval() if the /gpt/fixpath response parses as JSON.
- IOCs: extension ID ndgimibanhlabgdgjcpbbndiehljcpfh; domains selectorshub[.]info, shub.selectorshub[.]info, shubads.testcasehub[.]net, blomehairdryers[.]com; endpoints including /nodeapp/api/link-ads, /nodeapp/api/link/track, /gpt/fixpath.
🔓 CVEs & KEV
CVE-2026-105740 — langflow-ai langflow — CVSS 9.9 — Langflow Critical RCE: Authenticated Command Injection via Stdio Transport
CVE-2026-105697 — langflow-ai langflow — CVSS 9.9 — Langflow OS Command Injection Enables Unauthenticated Remote Code Execution
CVE-2026-21589 — Atlassian Bamboo Data Center — CVSS 9.3 — h3. Summary This is a vulnerability in Bitbucket Data Center, Confluence Data...
CVE-2026-0461 — AMD ZynqTM UltraScale+ MPSoCs — CVSS 7.5 — Insufficient boundary validation in the USB boot mode implementation of AMD Z...
CVE-2026-105744 — docling-project docling — CVSS 7.5 — Docling: Arbitrary file read/write (and command execution when shell-escape i...
CVE-2026-103433 — Docker Buildx — CVSS 6.9 — Bake filesystem entitlement consent is skipped for certain secret and oci-lay...
CVE-2026-105751 — docling-project docling — CVSS 6.9 — Docling: Arbitrary local file read via draw:image xlink:href in the OpenDocum...
CVE-2026-105745 — docling-project docling — CVSS 6.7 — Docling: Plugin entry points are imported before the allow_external_plugins c...
CVE-2026-105749 — docling-project docling — CVSS 6.5 — Docling: Unbounded table rowspan/colspan in HTML, JATS, ODS and BoxNote backe...