Microsoft Edge

CVE-2026-85046 Exploited in Chromium V8 Engine, Affecting Chrome, Edge and Other Browsers

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-85046 to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. The flaw resides in the V8 JavaScript engine of Chromium and stems from a type confusion issue that can allow arbitrary code execution inside the sandbox when a crafted HTML page is processed. Google released a patch for Chrome on September 3, 2026, while the vulnerability carries a CVSS v3.1 base score of 8.8 and is rated High severity. Because numerous browsers including Microsoft Edge, Opera, and Vivaldi are built on Chromium, they are potentially exposed until their respective vendors issue updates. Security teams are advised to verify that all Chromium-based browsers in their environments have been updated to the latest versions containing the fix.

Password Spraying Campaign Targets AWS Root Accounts in Over 150 Organizations

A password spraying campaign targeted AWS root accounts across more than 150 organizations between July 24 and August 23, 2026. Attackers performed repeated login attempts against identities holding maximum privileges in the cloud environment. The root account is created with every AWS account and grants full access to resources, configurations, billing, and sensitive administrative functions. Researchers observed a median of two attempts per organization, with some targets receiving up to eight attempts. No successful authentications linked to the campaign have been identified so far. The attacks leveraged distributed proxies across multiple countries and networks, including hosting infrastructure and residential proxies, while using user agents that mimicked older versions of Microsoft Edge and Firefox. Since June 2025, AWS has required MFA for root users, significantly raising the bar for account takeover even if a password is discovered.

APT28 Expands Espionage with New HOOKEDGE Backdoor Targeting European Organizations

The Russian-linked APT28 group, also known as BlueDelta, has deployed a new lightweight backdoor called HOOKEDGE as part of a cyber-espionage campaign against strategic European entities. The attacks, assessed with moderate confidence, targeted government, diplomatic, and defense manufacturing organizations in Romania, Spain, and Turkey between September 2025 and April 2026. Infection begins with spear-phishing emails delivering Microsoft Word documents containing malicious macros that mimic official Spanish government materials. Upon execution, the macros drop files, establish persistence via scheduled tasks, and deploy the HOOKEDGE backdoor written in batch scripts. The malware uses hidden Microsoft Edge instances and the legitimate webhook.site service to blend command-and-control traffic with normal web activity. In high-value victims, operators installed a second HOOKEDGE instance with five-minute check-ins for faster control and data collection. The backdoor shows strong code similarities to the older HEADLACE implant previously attributed to the same group.