Chrome Session Protection and Active WinRAR Exploitation Highlight Security Roundup
· 2:40:42 · Watch on YouTube ↗
Summary
Security Now discusses Chrome's device-bound session credentials, active exploitation of a WinRAR flaw, malicious browser extensions, spyware and privacy questions around age verification.
Key points
- Chrome 145 supports device-bound session credentials, which are designed to prevent stolen session cookies from being reused on another device. The feature also requires server-side support.
- Google's Threat Intelligence Group reported widespread exploitation of CVE-2025-8088 in WinRAR. Malicious archives can write files to arbitrary locations, including the Windows startup folder; WinRAR 7.13 fixed the flaw.
- Stairwell reported that more than 80% of its monitored environments contained WinRAR versions affected by the flaw.
- LayerX reported 30 Chrome extensions posing as AI assistants that used remotely controlled interfaces and privileged browser access; the extensions affected more than 260,000 users.
- A separate researcher reported 287 Chrome extensions that leaked browsing history, with 37.4 million collective installations.
- The hosts discussed Discord's stated age-verification privacy safeguards and raised concerns about third-party retention of identity documents.
- Photos of Paragon's Graphite control panel reportedly showed access to messages from several messaging apps, illustrating the risk posed by spyware on a compromised device.
Article Details
- Topics
- [02:50] Password manager research and server-side compromise scenarios
- [28:50] Microsoft security leadership and priorities
- [44:08] Chrome device-bound session credentials
- [55:36] Discord age assurance and identity-data privacy
- [01:01:52] Active exploitation of the WinRAR path traversal vulnerability
- [01:12:08] Graphite spyware and messaging-app data
- [01:15:43] Malicious AI assistant browser extensions
- [01:22:15] Browser extensions leaking browsing history