cyber.hendryadrian.com
YouTube · Hak5

Threat Wire Covers Chrome’s Silent Gemini Nano Downloads and Linux Dirty Frag Exploitation

· 8:13 · Watch on YouTube ↗

Summary

Threat Wire reports Chrome silently downloading and restoring Gemini Nano models, Linux Dirty Frag kernel flaws exploited for local privilege escalation, and ShinyHunters’ Canvas extortion, alongside AI security and certificate-service updates.

Key points

  • Google Chrome reportedly downloads a 4 GB Gemini Nano model without asking permission; its AI features are active by default, and deleting the model can trigger another download.
  • Reports cited in the video describe the model being downloaded again on Windows and macOS, including Apple Silicon. Disabling Chrome AI features or uninstalling Chrome are given as ways to prevent redownloading.
  • Microsoft confirmed exploitation of Dirty Frag, which chains CVE-2026-43284 and CVE-2026-43500 to achieve local privilege escalation through Linux kernel cache writes. The video reports that patches were unavailable.
  • The video reports that ShinyHunters took Canvas offline and stole data while holding the platform at ransom; Instructure appeared to have met the demands and paid.
  • Mozilla and Anthropic reportedly used Mythos to find 271 Firefox vulnerabilities over two months, with the video describing the results as having almost no false positives.
  • The roundup describes a Gemini CLI vulnerability that could enable remote code execution through malicious environment variables, and Trustfall issues where AI CLI tools could activate malicious repositories without prompting.
  • Google reportedly identified threat actors using AI to develop zero-day exploits. Separately, Let’s Encrypt paused certificate issuance over a cross-signing issue.

Article Details

Topics
  • [00:14] Researcher-reported Chrome downloads and repeated installation of the Gemini Nano model without a permission prompt
  • [02:54] Dirty Frag Linux kernel vulnerabilities, in-the-wild exploitation, and local privilege escalation
  • [04:55] ChatGPT 5.5 release and comparison with Mythos
  • [05:09] Mozilla and Mythos finding Firefox vulnerabilities
  • [05:24] Gemini CLI vulnerability involving untrusted folders and malicious environment variables
  • [05:38] Google’s report of threat actors using AI to develop zero-day exploits
  • [05:50] Trustfall vulnerabilities involving AI tools activating malicious repositories
  • [06:03] Let’s Encrypt certificate issuance pause over a cross-signing issue
  • ShinyHunters’ Canvas disruption, data theft, and ransom demands

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationDirty Frag chains two Linux kernel flaws to achieve local privilege escalation; the video says Microsoft confirmed exploitation in the wild.

Vendors

GoogleThe video reports Chrome downloading and restoring Gemini Nano without a permission prompt and describes Google’s report of threat actors using AI to develop zero-day exploits.MicrosoftMicrosoft confirmed that Dirty Frag was being exploited in the wild, according to the video.

Related Articles