Tag: google
-
Google Vertex AI Flaw Lets Low-Privilege Users Escalate to Service Agent Roles
Security researchers have discovered critical privilege escalation vulnerabilities in Google’s Vertex AI platform that allow attackers with minimal permissions to hijack high-privileged Service Agent accounts. The flaws affect the Vertex AI Agent Engine and Ray on Vertex AI, where default configurations enable low-privileged users to access powerful managed identities with project-wide permissions. As enterprises rapidly…
-
Fast Pair, loose security: Bluetooth accessories open to silent hijack
Sloppy implementation of Google spec leaves ‘hundreds of millions’ of devices vulnerable First seen on theregister.com Jump to article: www.theregister.com/2026/01/17/fast_pair_flaw/
-
Zero-Click Exploit Chain Discovered Targeting Google Pixel 9 Devices
Security researchers at Google Project Zero have disclosed a complete zero-click exploit chain affecting Google Pixel 9 smartphones, chaining vulnerabilities in the Dolby audio decoder and kernel driver to achieve code execution and privilege escalation without any user interaction. The exploit leverages three distinct vulnerabilities: CVE-2025-54957 in the Dolby Unified Decoder, CVE-2025-36934 in a kernel…
-
Critical WhisperPair flaw lets hackers track, eavesdrop via Bluetooth audio devices
A critical vulnerability in Google’s Fast Pair protocol can allow attackers to hijack Bluetooth audio accessories like wireless headphones and earbuds, track users, and eavesdrop on their conversations. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/critical-whisperpair-flaw-lets-hackers-track-eavesdrop-via-bluetooth-audio-devices/
-
Google Fast Pair: Sicherheitslücke macht Hörstöpsel zur Wanze
Sicherheitsforscher haben eine gravierende Schwachstelle in Googles Fast-Pair-Technologie für Bluetooth-Hörstöpsel entdeckt. First seen on golem.de Jump to article: www.golem.de/news/google-fast-pair-sicherheitsluecke-macht-hoerstoepsel-zur-wanze-2601-204253.html
-
Google now lets you change your @gmail.com address, rolling out
Google has confirmed that it’s now possible to change your @gmail.com address. This means that if your current email is xyz@gmail.com, you can now change it to abc@gmail.com. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/technology/google-now-lets-you-change-your-gmailcom-address-rolling-out/
-
New PayPal Scam Sends Verified Invoices With Fake Support Numbers
Hackread.com exclusive: Scammers are using verified PayPal invoices to launch callback phishing attacks. Learn how the “Alexzander” invoice bypasses Google filters. First seen on hackread.com Jump to article: hackread.com/paypal-scam-verified-invoices-fake-support-numbers/
-
2025 Threat Landscape in Review: Lessons for Businesses Moving Into 2026
Tags: access, ai, application-security, attack, authentication, awareness, backdoor, breach, business, captcha, cloud, compliance, container, control, credentials, credit-card, cybersecurity, data, data-breach, ddos, defense, encryption, exploit, finance, firewall, flaw, google, identity, infrastructure, intelligence, leak, malicious, mitigation, monitoring, network, pypi, risk, service, software, strategy, supply-chain, threat, tool, vulnerability, windows2025 Threat Landscape in Review: Lessons for Businesses Moving Into 2026 andrew.gertz@t“¦ Thu, 01/15/2026 – 16:48 Nadav Avital – Senior Director of Threat Research at Thales More About This Author > 2025 was a year that tested how businesses think about security. Some attacks happened in new, unexpected ways, while others employed old tricks, taken…
-
Many Bluetooth devices with Google Fast Pair vulnerable to “WhisperPair” hack
Even Google’s own earbuds are vulnerable to the Fast Pair hack. First seen on arstechnica.com Jump to article: arstechnica.com/gadgets/2026/01/researchers-reveal-whisperpair-attack-to-eavesdrop-on-google-fast-pair-headphones/
-
Predator-Spyware gefährlicher als gedacht
Bereits Ende 2024 veröffentlichte die Google Threat Intelligence Group erste Ergebnisse zu der Spyware Predator, die der Intellexa Alliance zugerechnet wird. Aufbauend auf diesen Erkenntnissen hat das Threat Labs Team von Jamf eigene Analysen durchgeführt First seen on it-daily.net Jump to article: www.it-daily.net/it-sicherheit/cybercrime/predator-spyware
-
Google plans to make Chrome for Android an agentic browser with Gemini
Google appears to be testing a new feature that integrates Gemini into Chrome for Android, allowing you to use agentic browser capabilities on your mobile device. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/artificial-intelligence/google-plans-to-make-chrome-for-android-an-agentic-browser-with-gemini/
-
Google’s Personal Intelligence links Gmail, Photos and Search to Gemini
Google is rolling out ‘Personal Intelligence,’ a new Gemini feature that pulls your data from Gmail, Photos, Google Search, and other products. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/artificial-intelligence/googles-personal-intelligence-links-gmail-photos-and-search-to-gemini/
-
OpenAI’s hidden ChatGPT Translate tool takes on Google Translate
OpenAI has quietly rolled out a new ChatGPT feature called ChatGPT Translate, and it looks very similar to Google Translate on the web. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/artificial-intelligence/openais-hidden-chatgpt-translate-tool-takes-on-google-translate/
-
New China Linked VoidLink Linux Malware Targets Major Cloud Providers
Researchers have discovered VoidLink, a sophisticated new Linux malware framework designed to infiltrate AWS, Google Cloud, and Azure. Learn how this Chinese-affiliated toolkit uses adaptive stealth to stay hidden. First seen on hackread.com Jump to article: hackread.com/china-voidlink-linux-malware-cloud-providers/
-
Android Users Hit by Volume Button Bug Linked to Select to Speak
Google has confirmed a critical bug affecting Android devices where volume buttons malfunction when the Select to Speak accessibility feature is enabled. The issue causes volume keys to adjust accessibility volume rather than media volume. It prevents the camera from capturing photos when the volume buttons are pressed during photography. Users with Select to Speak…
-
New Research: 64% of 3rd-Party Applications Access Sensitive Data Without Justification
Research analyzing 4,700 leading websites reveals that 64% of third-party applications now access sensitive data without business justification, up from 51% in 2024. Government sector malicious activity spiked from 2% to 12.9%, while 1 in 7 Education sites show active compromise.Specific offenders: Google Tag Manager (8% of violations), Shopify (5%), Facebook Pixel (4%).Download the First…
-
Google confirms Android bug causing volume key issues
Google has confirmed a software bug that is preventing volume buttons from working correctly on Android devices with accessibility features enabled. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/google/google-confirms-android-bug-causing-volume-key-issues/
-
Malicious Chrome Extension Steals MEXC API Keys by Masquerading as Trading Tool
Cybersecurity researchers have disclosed details of a malicious Google Chrome extension that’s capable of stealing API keys associated with MEXC, a centralized cryptocurrency exchange (CEX) available in over 170 countries, while masquerading as a tool to automate trading on the platform.The extension, named MEXC API Automator (ID: pppdfgkfdemgfknfnhpkibbkabhghhfh), has 29 downloads and is still First…
-
When the Marketing Graph Becomes the Target Map
Ad tech platforms likely know more about your executives than your security team does… and that information is available to anyone willing to pay for it. A recent investigation by Wired revealed that Google’s ad service hosted audience segments tied to highly sensitive groups, allowing marketers (and potential adversaries) to target mobile devices linked to..…
-
AuraInspector: Open-source tool to audit Salesforce Aura access control misconfigurations
Google and its Mandiant threat intelligence unit have released AuraInspector, an open-source tool aimed at auditing data access paths in Salesforce Experience Cloud … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/01/13/aurainspector-open-source-tool-salesforce-aura/
-
Q4 2025 Malware Trends: Telegram Backdoor, Banking Trojans Surge, Joker Returns to Google Play
Telegram mods spread a powerful Android backdoor as banking trojans surge and Joker malware resurfaces on Google Play in Q4 2025, says Doctor Web. First seen on hackread.com Jump to article: hackread.com/q4-2025-malware-telegram-backdoor-joker-google-play/
-
Russian BlueDelta (Fancy Bear) Uses PDFs to Steal Logins in Just 2 Seconds
New research from Recorded Future reveals how Russian state hackers (BlueDelta) are using fake Microsoft and Google login portals to steal credentials. The campaign involves using legitimate PDF lures from GRC and EcoClimate to trick victims. First seen on hackread.com Jump to article: hackread.com/russian-bluedelta-fancy-bear-pdfs-steal-login/
-
Threat Actors Launch Mass Reconnaissance of AI Systems
More Than 91,000 Attacks Target Exposed LLM Endpoints in Coordinated Campaigns. Two coordinated campaigns generated more than 91,000 attack sessions against AI infrastructure between October and January, with threat actors probing more than 70 model endpoints from OpenAI, Anthropic and Google to build target lists for future exploitation. First seen on govinfosecurity.com Jump to article:…
-
n8n Supply Chain Attack Abuses Community Nodes to Steal OAuth Tokens
Threat actors have been observed uploading a set of eight packages on the npm registry that masqueraded as integrations targeting the n8n workflow automation platform to steal developers’ OAuth credentials.One such package, named “n8n-nodes-hfgjf-irtuinvcm-lasdqewriit,” mimics a Google Ads integration, and prompts users to link their advertising account in a seemingly legitimate form and then First…
-
Apple confirms Google Gemini will power Siri, says privacy remains a priority
Apple and Google have confirmed that the next version of Siri will use Gemini and Google Cloud in a multi-year collaboration between the two tech giants. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/apple/apple-confirms-google-gemini-will-power-siri-says-privacy-remains-a-priority/
-
Tenable Is a Gartner® Peer Insights Customers’ Choice for Cloud-Native Application Protection Platforms
Tags: ai, api, attack, automation, banking, ciso, cloud, compliance, control, cybersecurity, data, detection, gartner, google, governance, healthcare, identity, infrastructure, microsoft, risk, risk-management, service, software, strategy, technology, tool, vulnerability, vulnerability-managementThis recognition, based entirely on feedback from the people who use our products every day, to us is a testament to the unmatched value Tenable Cloud Security CNAPP offers organizations worldwide. Our key takeaways: In our view, this peer recognition confirms Tenable’s strategic value in helping organizations worldwide, across all industry sectors, preemptively close critical…
-
Google Chrome Pushes Critical Security Update for 3B Users
Google patched high-severity CVE-2026-0628 in Chrome 143 and added Push API rate limits to curb notification spam, with penalties up to 14 days. The post Google Chrome Pushes Critical Security Update for 3B Users appeared first on TechRepublic. First seen on techrepublic.com Jump to article: www.techrepublic.com/article/news-google-chrome-vulnerabilities-3b/