---
title: "#browsersecurity articles | Hashnode"
description: "Explore 4 articles tagged #browsersecurity on Hashnode. Tutorials, guides, and how-tos from the community."
url: "https://hashnode.com/tag/browsersecurity"
---

Tag

# #browsersecurity

4 posts · 0 followers

[ZyVOP](https://hashnode.com/@zyvop) · [Sep 14](https://hashnode.com/posts/the-deathray-a-simple-way-for-an-untrusted-site-to-freeze-a-mac/6aa7eb255b225755f6166599)

### [The Deathray: A Simple Way for an Untrusted Site to Freeze a Mac](https://blog.zyvop.com/the-deathray-a-simple-way-for-an-untrusted-site-to-freeze-a-mac?utm_source=hashnode&utm_medium=feed)

A WebGPU bug lets any website hang a Mac's entire desktop with one click — and Apple says it's not a security issue.

8 min read · [blog.zyvop.com](https://blog.zyvop.com/the-deathray-a-simple-way-for-an-untrusted-site-to-freeze-a-mac?utm_source=hashnode&utm_medium=feed)

[ZyVOP](https://hashnode.com/@zyvop) · [Sep 7](https://hashnode.com/posts/the-sandbox-held-the-headline-didnt/6a9e4c561fc543a8a1f657cb)

### [The Sandbox Held. The Headline Didn't.](https://blog.zyvop.com/the-sandbox-held-the-headline-didnt?utm_source=hashnode&utm_medium=feed)

Inside CVE-2026-85046, Chrome's sixth zero-day of 2026 and third in V8 — and why 'sandbox RCE in all Chromium versions' oversells and undersells the real story

15 min read · [blog.zyvop.com](https://blog.zyvop.com/the-sandbox-held-the-headline-didnt?utm_source=hashnode&utm_medium=feed)

[DeepSeaX](https://hashnode.com/@deepseax) · [Mar 3](https://hashnode.com/posts/fake-google-security-alert-installs-pwa-that-steals-mfa-codes/69a66ca45fe65b6733d5e32e)

### [Fake Google Security Alert Installs PWA That Steals MFA Codes](https://deepseax.hashnode.dev/fake-google-security-alert-installs-pwa-that-steals-mfa-codes?utm_source=hashnode&utm_medium=feed)

A phishing campaign uses google-prism.com to install a fake Google security PWA that steals MFA codes via WebOTP API, exfiltrates GPS and contacts, and acts as a browser RAT.

4 min read · [deepseax.hashnode.dev](https://deepseax.hashnode.dev/fake-google-security-alert-installs-pwa-that-steals-mfa-codes?utm_source=hashnode&utm_medium=feed)

[DeepSeaX](https://hashnode.com/@deepseax) · [Mar 2](https://hashnode.com/posts/cve-2026-0628-chrome-extensions-exploit-gemini-panel-for-privilege-escalation/69a5fcb4d011f4e1036939d5)

### [CVE-2026-0628: Chrome Extensions Exploit Gemini Panel for Privilege Escalation](https://deepseax.hashnode.dev/cve-2026-0628-chrome-extensions-exploit-gemini-panel-for-privilege-escalation?utm_source=hashnode&utm_medium=feed)

CVE-2026-0628 lets malicious Chrome extensions hijack the Gemini AI panel to access cameras, files, and run arbitrary code. Patch now.

3 min read · [deepseax.hashnode.dev](https://deepseax.hashnode.dev/cve-2026-0628-chrome-extensions-exploit-gemini-panel-for-privilege-escalation?utm_source=hashnode&utm_medium=feed)

[Frozzipies](https://hashnode.com/@frozzipies) · [Jun 1, 2025](https://hashnode.com/posts/chromium-vrp-bypass-characters-on-filename-lead-to-file-origin-spoofing/683c28e3cde7a310bd8edac4)

### [\[Chromium VRP\] Bypass :// Characters on Filename lead to File Origin Spoofing](https://bountyproofs.com/chromium-vrp-bypass-characters-on-filename-lead-to-file-origin-spoofing?utm_source=hashnode&utm_medium=feed)

Pada kesempatan kali ini saya akan membahas kerentanan yang agak berbeda, yaitu kerentanan browser spoofing. Kerentanan yang saya temukan ini terjadi ketika seorang attacker bisa memanipulasi origin atau source dari suatu file ketika di download. Con...

3 min read · [bountyproofs.com](https://bountyproofs.com/chromium-vrp-bypass-characters-on-filename-lead-to-file-origin-spoofing?utm_source=hashnode&utm_medium=feed)