Skip to main content

Unpatched Bug Can Crash Chromium-Based Browsers in Seconds

6 days 18 hours ago
A critical security flaw in Chromium's Blink rendering engine can crash billions of browsers within seconds. Security researcher Jose Pino discovered the vulnerability and created a proof-of-concept exploit called Brash to demonstrate the bug affecting Chrome, Edge, OpenAI's ChatGPT Atlas, Brave, Vivaldi, Arc, Dia, Opera and Perplexity Comet. The flaw, reports The Register, exploits the absence of rate limiting on document.title API updates in Chromium versions 143.0.7483.0 and later. The attack injects millions of DOM mutations per second and saturates the main thread. When The Register tested the code on Edge, the browser crashed and the Windows machine locked up after about 30 seconds while consuming 18GB of RAM in one tab. Pino disclosed the bug to the Chromium security team on August 28 and followed up on August 30 but received no response. Google said it is looking into the issue.

Read more of this story at Slashdot.

msmash

Claude code will send your data to crims ... if they ask it nicely

6 days 18 hours ago
Company tells users concerned about exfiltration to 'stop it if you see it'

A researcher has found a way to trick Claude into uploading private data to an attacker's account using indirect prompt injection. Anthropic says it has already documented the risk, and its foolproof solution is: keep an eye on your screen.…

Thomas Claburn

AI 'Cheating' App Founder Says Engineers Can't Make Good, Viral Content and That's Why Their Startups Flop

6 days 19 hours ago
AI "cheating" app Cluely's CEO and cofounder, Chungin "Roy" Lee, said most startups flop because their products don't get seen. From a report: "Engineers just cannot make good content," Lee said during a Wednesday interview at TechCrunch Disrupt 2025 "There's a bunch of shallow replicas, but I challenge you to find one video you think is like, 'Yo, this is as tough as Cluely,'" he told TechCrunch. Every startup needs to focus more on distribution. And most startups flop because they fail to get seen, even if they have product-market fit, Lee said. Cluely launched earlier this year as a tool to help software engineers cheat on their job interviews, among other use cases. The startup earlier this year posted a tongue-in-cheek video of Lee trying to use Cluely to impress a woman on a date, which went viral.

Read more of this story at Slashdot.

msmash

Google Makes First Play Store Changes After Losing Epic Games Antitrust Case

6 days 19 hours ago
An anonymous reader quotes a report from Ars Technica: Since launching Google Play (nee Android Market) in 2008, Google has never made a change to the US store that it didn't want to make -- until now. Having lost the antitrust case brought by Epic Games, Google has implemented the first phase of changes mandated by the court. Developers operating in the Play Store will have more freedom to direct app users to resources outside the Google bubble. However, Google has not given up hope of reversing its loss before it's forced to make bigger changes. Epic began pursuing this case in 2020, stemming from its attempt to sell Fortnite content without going through Google's payment system. It filed a similar case against Apple, but the company fell short there because it could not show that Apple put its thumb on the scale. Google, however, engaged in conduct that amounted to suppressing the development of alternative Android app stores. It lost the case and came up short on appeal this past summer, leaving the company with little choice but to prepare for the worst. Google has updated its support pages to confirm that it's abiding by the court's order. In the US, Play Store developers now have the option of using external payment platforms that bypass the Play Store entirely. This could hypothetically allow developers to offer lower prices, as they don't have to pay Google's commission, which can be up to 30 percent. Devs will also be permitted to direct users to sources for app downloads and payment methods outside the Play Store. Google's support page stresses that these changes are only being instituted in the US version of the Play Store, which is all the US District Court can require. The company also notes that it only plans to adhere to this policy "while the US District Court's order remains in effect." Judge James Donato's order runs for three years, ending on November 1, 2027.

Read more of this story at Slashdot.

BeauHD

Proton trains new service to expose corporate infosec cover-ups

6 days 19 hours ago
Service will tell on compromised organizations, even if they didn't plan on doing so themselves

Some orgs would rather you not know when they've suffered a cyberattack, but a new platform from privacy-focused tech firm Proton will shine a light on the big breaches that might otherwise stay buried.…

Connor Jones

Zuckerberg Getting Ready To Dump More AI Content To Social Feeds

6 days 20 hours ago
Meta CEO Mark Zuckerberg is getting ready to dump even more AI-generated posts into your social feeds. From a report: During an earnings call on Wednesday, Zuckerberg said the company will "add yet another huge corpus of content" to its recommendations system as AI "makes it easier to create and remix" work that gets shared online. "Social media has gone through two eras so far," Zuckerberg said. "First was when all content was from friends, family, and accounts that you followed directly. The second was when we added all of the Creator content." Though Zuckerberg stops short of calling AI the third era of social media, it's clear that the technology will be heavily involved in what comes next. Zuckerberg said that recommendation systems that "deeply understand" AI-generated posts and "show you the right content" will become "increasingly valuable." The company has already begun embedding AI tools across its apps and is now experimenting with dedicated AI social apps, too.

Read more of this story at Slashdot.

msmash