Summary : Security advisory: Google has released an urgent security update to patch two high-severity Type Confusion vulnerabilities in the V8 JavaScript engine. The CVEs vulnerabilities are CVE-2025-13223, CVE-2025-13224 .
OEM
Google
Severity
High
CVSS Score
8.8
CVEs
CVE-2025-13223, CVE-2025-13224
POC Available
No
Actively Exploited
Yes
Exploited in Wild
Yes
Advisory Version
1.0
Overview
One of these vulnerability (CVE-2025-13223) is already being actively exploited in the wild, allowing attackers to potentially execute arbitrary code through malicious web content. which attackers can bypass Chrome’s sandbox, steal sensitive data, or deploy malware. The fixes have been rolled out for Chrome Stable 142.0.7444.175/.176 across Windows, Mac, and Linux.
Vulnerability Name
CVE ID
Product Affected
Severity
Fixed Version
Type Confusion Vulnerability in V8 JavaScript Engine
CVE-2025-13223
Google Chrome
High
v142.0.7444.175 / v142.0.7444.176
Type Confusion Vulnerability in V8 JavaScript Engine
CVE-2025-13224
Google Chrome
High
v142.0.7444.175 / v142.0.7444.176
Technical Summary
Both vulnerabilities occur from Type Confusion vulnerabilities in Chrome’s V8 engine, where incorrect data-type handling leads to memory corruption and possible code execution. The CVE-2025-13223 is already being exploited in the wild and may involve APT-driven activity.
Another vulnerability was found internally through Google’s Big Sleep fuzzing system as part of ongoing proactive defense.
These weaknesses can allow attackers to bypass browser security boundaries and execute malicious actions remotely. Urgent need for users and administrators to apply Chrome’s latest security updates immediately.
CVE ID
System Affected
Vulnerability Details
Impact
CVE-2025-13223
Google Chrome (V8 Engine)
Type confusion due to improper type handling in V8 allowing memory corruption.
Remote Code Execution, Sandbox Escape
CVE-2025-13224
Google Chrome (V8 Engine)
Type confusion triggered during script execution, discovered via fuzzing
Remote Code Execution, Browser Crash
Remediation:
Immediate Action: Users and organization administrators should update Chrome immediately to the following patched versions:
Windows: 142.0.7444.175 / 142.0.7444.176
MacOS: 142.0.7444.176
Linux: 142.0.7444.175
Here are some recommendations below
Enforce Chrome auto-updates on all endpoints via enterprise policies.
Monitor browser crash logs and unusual behaviors tied to JavaScript execution.
Run updated vulnerability & patch management tools to ensure full endpoint compliance.
Educate users to avoid suspicious links and unknown websites during active exploitation events
Conclusion: With Chrome being the most widely used browser globally, prompt updates are essential for the new security vulnerabilities. Maintaining browsers at the latest versions remains the strongest defenses against modern web-based attacks in modern cyber world.
Zoho Analytics on-premise installations were recently found to have a SQL Injection vulnerability- CVE-2025-8324 that exposes enterprise environments to risk. The flaw is prevalent in all Zohocorp ManageEngine products, built prior to the most recent patch and enables attackers to exploit weaknesses in the application’s input validation logic.
The flaw enables attackers to execute queries without authentication mainly arbitrary SQL injection, without prior authentication, leading to unauthorized data exposure and account takeovers.
OEM
Zoho
Severity
Critical
CVSS Score
9.8
CVEs
CVE-2025-8324
POC Available
No
Actively Exploited
No
Exploited in Wild
No
Advisory Version
1.0
Overview Malicious actors can launch attacks remotely and takeover user accounts, sensitive analytics data and any connected business intelligence workflows. Administrators are urged to update to the latest version to mitigate this risk.
Vulnerability Name
CVE ID
Product Affected
Severity
Fixed Version
Unauthenticated SQL Injection
CVE-2025-8324
Zoho Analytics On-Premise
Critical
6171 and later
Technical Summary
At the root of this flaw is improper input validation for user-supplied parameters within specific URLs of the Zoho Analytics Plus backend.
This allows arbitrary SQL queries to be executed by anyone with network access to the service, even if they have no login credentials. Zoho has enforced input checks and removing vulnerable backend components altogether.
CVE ID
Component Affected
Vulnerability Details
Impact
CVE-2025-8324
Zoho Analytics Plus On-Premise
An unauthenticated SQL injection vulnerability caused by improper input validation allowing attackers to inject arbitrary SQL queries remotely without authentication.
Account takeover, user data leak
Recommendations
Organizations must update Zoho Analytics Plus On-Premises immediately to the Build 6171 version or later.
Here are some recommendations you can follow
Enforce patch deployment across all managed analytics instances to ensure consistency and security.
Continuously monitor logs for unusual SQL query activities or access attempts that could indicate exploitation attempts.
Conclusion: The Zoho Analytics On-Premise deployments, could enable full data and account compromise through unauthenticated SQL injection. CVE-2025-8324 represents a critical security risk, classified at the highest severity level due to its potential impact and ease of exploitation.
Although no active exploitation has been detected to date, the severity of the flaw demands immediate attention. Immediate patching is essential to secure environments and prevent any chance of data compromise or unauthorized access.
Summary : Mozilla released the Firefox 145 Security Update on November 11, 2025, addressing 16 vulnerabilities affecting multiple components allowing arbitrary code execution.
The Mozilla Firefox advisory details reveal that exploiting these vulnerabilities requires attackers to deliver malicious content via compromised websites or through network attacks. The vulnerability landscape reveals concerning patterns in critical components where WebGPU graphics processing emerges as a significant attack surface, with five separate boundary condition flaws identified.
Mozilla released the Firefox 145 Security Update on November 11, 2025, addressing 16 vulnerabilities affecting multiple components.
The patched vulnerabilities include memory safety bugs, boundary errors, race conditions, and sandbox escapes that could allow remote code execution (RCE), privilege escalation or data exposure. Although no active exploitation has been reported. Users and administrators should upgrade immediately to prevent exploitation and maintain browser security integrity.
Technical Summary
Memory corruption and sandbox escape issues could allow attackers to run malicious code or bypass.
Firefox’s isolation controls, leading to full system compromise. WebRTC and multimedia use-after-free bugs further increase the risk of crashing or leaking live data.
Though no exploitation has been detected, users and enterprises should update immediately to reduce exposure to emerging browser-based threats.
CVE ID
System Affected
Vulnerability Details
Impact
CVE-2025-13012
Graphics Subsystem
Race condition vulnerability leads to system crash or remote execution.
Remote Code Execution
CVE-2025-13016
JavaScript: WebAssembly
Incorrect memory boundary validation allows code execution through crafted scripts.
Remote Code Execution
CVE-2025-13021
Graphics: WebGPU
Boundary condition errors may cause memory corruption and remote code execution.
Remote Code Execution
CVE-2025-13022
Graphics: WebGPU
Boundary error in WebGPU rendering pipeline allowing memory corruption
Memory safety errors across multiple components allow arbitrary code execution.
Remote Code Execution
Source: Microsoft, Cybersecurity News
In addition to several high severity vulnerabilities, the update also addresses several other Medium and Low severity vulnerabilities across browser subsystems –
CVE-2025-13017: DOM Notifications Origin Bypass – Same-origin policy bypass may expose user data or notifications to untrusted sites. (Medium)
CVE-2025-13018: DOM Security Mitigation Bypass – Allows limited circumvention of built-in browser security controls. (Medium)
CVE-2025-2884: TCG TPM 2.0 Vulnerability – Out-of-bounds read in TPM cause info disclosure or DoS, impacting secure boot. (Medium)
CVE-2025-13019: DOM Workers Origin Bypass – May expose cross-origin content or enable script injection. (Medium)
CVE-2025-13013: DOM Core/HTML Mitigation Bypass – Allows controlled bypass of HTML sanitization in certain contexts. (Medium)
CVE-2025-13014: Audio/Video Use-After-Free – Memory mismanagement issue that could leak multimedia data or crash browser. (Medium)
Update all Firefox to version 145 immediately to mitigate the vulnerabilities.
Here are some recommendations below
Enable automatic browser updates across all systems.
Perform vulnerability scans to ensure no outdated browser versions remain.
Restrict use of WebGPU or WebAssembly APIs in enterprise environments unless essential.
Educate employees about risks from phishing, drive-by downloads and malicious extensions.
Conclusion: The Firefox 145 update is a critical security release addressing sixteen vulnerabilities across graphics, WebGPU, JavaScript engine, DOM, and WebRTC components.
Immediate patching and adherence to strong security hygiene are essential to prevent remote code execution, sandbox escapes, and data leaks. Timely remediation ensures operational continuity and protection of both individual and enterprise users against evolving exploitation techniques targeting browser flaws.
Improving browsing behavior significantly reduces risk exposure of users. Reporters Oskar L and Jamie Nicol highlighted how these bugs exploit WebGPU’s high-performance rendering, a feature increasingly targeted as web apps grow more graphics-intensive.
Summary : Microsoft’s November 2025 Patch Tuesday resolves 63 vulnerabilities across multiple Microsoft components. The Microsoft Patch Tuesday also addresses four “Critical” vulnerabilities, two of which are remote code execution vulnerabilities, one is an elevation of privileges and the fourth is an information disclosure flaw.
OEM
Microsoft
Severity
Critical
Date of Announcement
2025-11-11
No. of Patches
63
Actively Exploited
Yes
Exploited in Wild
Yes
Advisory Version
1.0
Overview : Key Updateson Patch Tuesday
The update includes one actively exploited zero-day vulnerability (CVE-2025-62215) in the Windows Kernel and five additional Critical-rated vulnerabilities affecting Office, DirectX, GDI+, Visual Studio, and Nuance PowerScribe.
This release continues Microsoft’s focus on privilege escalation and remote code execution (RCE) vulnerabilities, highlighting the urgent need for comprehensive patch management across enterprise systems.
Here are the CVE addresses for Microsoft & non-Microsoft:
63 Microsoft CVEs addressed
5 non-Microsoft CVEs addressed (Republished)
Breakdown of October 2025 Vulnerabilities
29 Elevation of Privilege (EoP)
16 Remote Code Execution (RCE)
11 Information Disclosure
3 Denial of Service (DoS)
2 Security Feature Bypass
2 Spoofing
Source: Microsoft
Vulnerability Name
CVE ID
Product Affected
Severity
CVSS Score
Windows Kernel Elevation of Privilege Vulnerability (Zero-Day, Exploited in Wild)
CVE-2025-62215
Windows 10, 11, Server 2016–2022
Critical
9.0
Microsoft Office Use-After-Free Remote Code Execution Vulnerability
CVE-2025- 62199
Microsoft Office (Word/Excel/Office Suite)
Critical
9.8
Nuance PowerScribe Missing Authorization Information Disclosure Vulnerability
CVE-2025-30398
Nuance PowerScribe 360
Critical
9.1
Windows DirectX Graphics Kernel Use-After-Free Vulnerability
CVE-2025-60716
Windows DirectX Graphics Kernel
Critical
8.8
Microsoft GDI+ Heap-Based Buffer Overflow RCE Vulnerability
CVE-2025-60724
Microsoft Graphics Component (GDI+)
Critical
8.7
Visual Studio Command Injection Remote Code Execution Vulnerability
CVE-2025-62214
Microsoft Visual Studio / Visual Studio Code
Critical
8.1
Technical Summary
The zero-day is a Windows Kernel bug that lets attackers gain full system control. Other critical & important vulnerabilities include Office and GDI+ vulnerabilities that could allow hackers to run malicious code or steal data.
Microsoft also patched issues in Visual Studio, DirectX, and Azure services. Users and admins are strongly advised to install these updates right away to stay protected.
CVE ID
System Affected
Vulnerability Details
Impact
CVE-2025-62215
Windows Kernel
Race conditions in shared resource execution enables local attackers to elevate privileges to SYSTEM (Zero-Day; Exploited in Wild)
Elevation of Privilege
CVE-2025-62199
Microsoft Office
Use-after-free vulnerability in Office allows RCE via malicious documents, typically delivered through phishing campaigns
Remote Code Execution
CVE-2025-30398
Nuance PowerScribe 360
Missing authorization vulnerability allows disclosure of sensitive medical or user data over the network
Information Disclosure
CVE-2025-60716
Windows DirectX Graphics Kernel
Use-after-free conditions allow local attackers to escalate privileges, potentially compromising the entire system
Elevation of Privilege
CVE-2025-60724
Microsoft GDI+
Heap-based buffer overflow allows attackers to execute arbitrary code remotely via crafted network traffic or malicious files
Remote Code Execution
CVE-2025-62214
Visual Studio
Command injection vulnerability allows attackers to execute arbitrary code locally in developer environments
Remote Code Execution
Source: Microsoft
In addition to several other Important severity vulnerabilities were addressed below –
The November 2025 security updates address critical and important vulnerabilities across a broad range of Microsoft products and services:
Windows Core Components
Updates for Kernel, Hyper-V, Kerberos, RRAS, WinSock, Smart Card, Bluetooth subsystems.
Microsoft Office Suite
Patches for Word, Excel, and related components impacted by RCE and Information Disclosure vulnerabilities.
Azure & Cloud Services
Fixes for Azure Monitor Agent, Dynamics 365, Entra ID, and related connectors.
Graphics Components
Patches for GDI+, DirectX, WSL GUI.
Developer Tools
Updates for Visual Studio, Visual Studio Code, and GitHub Copilot.
Third-Party Applications
Patches for Nuance PowerScribe (Medical domain).
Mobile Platform Technologies
Updates for Microsoft OneDrive for Android.
Remediation:
Install the November 2025 Microsoft security updates immediately across all Windows, Office, and Azure systems.
Here are some recommendations below
Monitor for Indicators of Compromise (IoCs) for privilege escalation attempts, new SYSTEM-level services, or unusual Office file crashes.
Ensure Windows 10 ESU enrollment for extended support systems.
Restrict local admin privileges and enforce least-privilege access.
Leverage EDR/SIEM solutions to detect suspicious kernel and Office activity.
Segment critical systems and disable unused network services (RRAS, SMB).
Conclusion: Microsoft’s November 2025 Patch Tuesday resolves 63 vulnerabilities, including one actively exploited Zero-Day and multiple Critical RCE and EoP vulnerabilities in Office, Windows Kernel, GDI+, and Visual Studio.
Given the confirmed exploitation and the presence of memory corruption vulnerabilities, immediate patch deployment is necessary to prevent potential ransomware and privilege escalation attacks in our modern cyber world.
Summary : A critical unauthenticated access vulnerability in Triofox is being actively exploited in the wild by threat actor UNC6485. Attackers exploit a Host header spoofing vulnerability to bypass authentication, create native admin accounts and chain abuse of the built-in antivirus feature to execute arbitrary code under SYSTEM privileges.
OEM
Gladinet
Severity
Critical
CVSS Score
9.1
CVEs
CVE-2025-12480
POC Available
YES
Actively Exploited
YES
Exploited in Wild
YES
Advisory Version
1.0
Overview
Triofox is an enterprise file-sharing and remote access platform by Gladinet that enables secure file sync, sharing, and collaboration across on-premises and cloud environments. Immediate upgrade is mandatory to prevent full system compromise, ransomware and persistent remote access.
Vulnerability Name
CVE ID
Product Affected
Severity
Fixed Version
Unauthenticated Access via Host Header Spoofing & Antivirus RCE Chain
CVE-2025-12480
Triofox
Critical
v16.7.10368.56560 or later
Technical Summary
The vulnerability in the CanRunCriticalPage() function within GladPageUILib.dll, which allows access to setup pages, if the Host header is “localhost” – without validating the request origin. Attackers spoof this header externally to initiate the setup process, create a Cluster Admin account, and gain authenticated access.
Once logged in, attackers exploit the antivirus configuration feature, which allows arbitrary executable paths. By uploading a malicious script to a shared folder and setting it as the antivirus scanner, the file executes with SYSTEM-level privileges inherited from the Triofox service.
CVE ID
System Affected
Vulnerability Details
Impact
CVE-2025- 12480
Triofox < 16.7.10368.56560
Host header attack bypasses authentication to AdminDatabase.aspx that enables admin account creation. Chained with antivirus path abuse to run uploaded payloads as SYSTEM
Authentication Bypass, Admin Account Creation, Remote Code Execution, Full System Compromise, Persistent Access, Data Exfiltration, Lateral Movement
IP address of the attacker used to initially exploit CVE-2025-12480 to create the admin account and gain access to the Triofox instance
65.109.204[.]197
AS24950 – Hetzner Online GmbH
After a dormant period, the threat actor used this IP address to login back into the Triofox instance and carry out subsequent activities
84.200.80[.]252
AS214036 – Ultahost, Inc.
IP address hosting the installer for the Zoho UEMSAgent remote access tool
216.107.136[.]46
AS396356 – LATITUDE-SH
Plink C2
Source: cloud.google.com
Recommendations:
Upgrade Triofox to version 16.7.10368.56560 or latest from the official Gladinet portal.
Conclusion: This vulnerability represents a severe supply-chain risk in enterprise file-sharing platforms, enabling zero-authentication RCE through misconfigured access controls and feature abuse. With active in-the-wild exploitation by UNC6485 and rapid post-patch attacks, delayed patching significantly increases breach likelihood.
Immediate upgrade, log monitoring, and network hardening are essential to prevent ransomware deployment, data theft, and network pivoting. This incident reinforces the need for secure-by-design input validation and principle of least privilege in remote access tools.
Summary : Amazon patched a vulnerability in the Linux version of its Workspace’s client that improperly handles authentication tokens in versions from 2023.0 through 2024.8.
OEM
Amazon
Severity
High
CVSS Score
8.8
CVEs
CVE-2025-12779
POC Available
No
Actively Exploited
No
Exploited in Wild
No
Advisory Version
1.0
Overview
This flaw allows local users on the same machine such as in shared, multi-user environments to extract valid authentication tokens.
Often used to impersonate other users and gain unauthorized access to their virtual desktop sessions, exposing sensitive data and applications.
The issue does not allow remote exploitation, but it poses a significant risk in workplaces using shared Linux systems for Workspace’s access.
Vulnerability Name
CVE ID
Product Affected
Severity
Fixed Version
Improper Authentication Token Handling in Amazon WorkSpaces Client
CVE-2025-12779
Amazon WorkSpaces client for Linux
High
2025.0
Technical Summary
The root cause lies in insecure management of authentication tokens, enabling token extraction by unintended local users. This vulnerability was assigned to high severity, prompting Amazon to issue a fix in the 2025.0 version of the client.
The update improves session isolation and secures token handling, protecting against lateral token theft.
Users and Administrators are strongly advised to upgrade promptly to avoid unauthorized access risks associated with multi-user Linux setups commonly found in corporate or virtual machine environments.
CVE ID
Component Affected
Vulnerability Details
Impact
CVE-2025-12779
Amazon WorkSpaces client for Linux (versions 2023.0 through 2024.8)
Local users on shared Linux machines can extract authentication tokens due to improper token handling, allowing them to access other users’ Workspaces.
Unauthorized access to another user’s workspace
Recommendations
Update the Amazon Workspace’s client for Linux immediately to version 2025.0 or later.
Conclusion: This vulnerability highlights the criticality of robust token security in virtual desktop clients, especially for environments with shared access.
Amazon’s swift patch release underscores the need for continuous vigilance and timely updates to maintain secure remote workspace solutions and prevent privilege escalation through token leakage. Upgrading to the patched version effectively mitigates the exposure and secures user sessions.
Summary : The recent Google Chrome update fixed several serious security issues that could let hackers take control of the browser or steal personal data. These vulnerabilities were mostly related to memory handling and scripting errors in important parts of Chrome like the JavaScript engine (V8) and browser interfaces.
Problems like type confusion and memory misuse could allow attackers to run harmful code just by making users visit malicious websites. Some flaws also affected Chrome’s UI, media processing and extension systems exposing users to possible unauthorized access or data leaks.
Vulnerability Name
CVE ID
Product Affected
Severity
Fixed Version
Out-of-Bounds Write in WebGPU
CVE-2025-12725
Chrome
High
142.0.7444.134/135
Inappropriate Implementation in Views (UI Rendering)
CVE-2025-12726
Chrome
High
142.0.7444.134/135
Inappropriate Memory Handling in V8 JavaScript Engine
CVE-2025-12727
Chrome
High
142.0.7444.134/135
Inappropriate Implementation in Omnibox (Unified Search Bar)
CVE-2025-12728
Chrome
Medium
142.0.7444.134/135
Inappropriate Implementation in Omnibox (Unified Search Bar)
CVE-2025-12729
Chrome
Medium
142.0.7444.134/135
Technical Summary
The bugs included memory corruption issues such as out-of-bound writings and use-after-free errors, which can lead to unpredictable behavior and remote code execution (RCE).
The JavaScript engine vulnerabilities involved mishandling data types or incorrect implementation, enabling attackers to break security boundaries.
Other issues involved UI security logic problems that could mislead users or weaken protections. Google patched all these weaknesses by tightening input validations, fixing memory lifecycle bugs, correcting UI behavior and strengthening internal security checks.
CVE ID
Component Affected
Vulnerability Details
Impact
CVE-2025-12725
Google Chrome (WebGPU)
Out-of-bounds write in WebGPU due to improper bounds checking, allowing attackers to overwrite memory beyond allocated limits.
Remote Code Execution / Browser Crash
CVE-2025-12726
Google Chrome (Views UI)
Inappropriate implementation in the Views component causing memory corruption.
UI rendering
CVE-2025-12727
Google Chrome (V8 Engine)
Improper handling in the V8 JavaScript engine enabling potential arbitrary code execution through crafted scripts.
Remote Code Execution
CVE-2025-12728
Google Chrome (Omnibox)
Flaws in Omnibox’s implementation could allow UI spoofing or navigation bar manipulation.
UI Spoofing
CVE-2025-12729
Google Chrome (Omnibox)
Similar flaws in Omnibox affecting input validation, leading to potential security bypasses or deceptive UI.
UI Spoofing / Security Bypass
Recommendations
Update Chrome immediately to the following versions:
For windows 142.0.7444.134/.135
For MacOS 142.0.7444.135
For Linux 142.0.7444.134
You can update by Open Chrome Settings → Help → About Google Chrome, then allow Chrome to check for and install updates immediately.
Along with update you can follow the recommendations below as well
Enforce Chrome auto-updates across managed endpoints using enterprise policy controls.
Actively monitor browser crash reports or any suspicious logs potentially linked to exploit attempts.
Use vulnerability & patch management tools to ensure all endpoints are running the latest version of all applications.
Conclusion: The Chrome security flaws can compromise devices just through browsing. Because millions use Chrome daily, these gaps were a high risk and google already patched those issues. Keeping any application to the latest version which is the best defense against cyber threats aiming at browsers.
Summary:Apple released iOS 26.1 and iPadOS 26, addressed multiple security vulnerabilities across core system components including WebKit, Kernel, Accessibility, Apple Neural Engine, CloudKit etc.
These vulnerabilities could enable malicious apps to escape sandboxes, access sensitive user data, execute arbitrary code via web content, monitor keystrokes or disable theft protection mechanisms. Affected devices include iPhone 11 & later and iPad models from 3rd gen onward etc. Immediate update is strongly recommended to prevent any breaches, system crashes.
Vulnerability Name
CVE ID
Product Affected
Fixed Version
WebKit Use-After-Free (Safari Crash/RCE)
CVE-2025-43438
iOS, iPadOS
iOS/iPadOS 26.1
WebKit Buffer Overflow (RCE Risk)
CVE-2025-43429
iOS, iPadOS
iOS/iPadOS 26.1
App Installed Detection via Accessibility
CVE-2025-43442
iOS, iPadOS
iOS/iPadOS 26.1
Sensitive Screenshot in Embedded Views
CVE-2025-43455
iOS, iPadOS
iOS/iPadOS 26.1
Kernel Memory Corruption / DoS
CVE-2025-43398
iOS, iPadOS
iOS/iPadOS 26.1
Technical Summary:
The iOS/iPadOS 26.1 update fixes major security issues in sandbox protection, memory handling, privacy settings, and the WebKit browser engine. These critical vulnerabilities could allow apps or websites to access restricted data or execute malicious code. Key impact issues mentioned below.
CVE ID
Component Affected
Vulnerability Details
Impact
CVE-2025-43438
WebKit
Use-after-free in Safari triggers crash or code execution via malicious web content
Remote Code Execution, System Compromise
CVE-2025-43429
WebKit
Buffer overflow in content processing allows arbitrary code execution
Remote Code Execution, Service Compromise
CVE-2025-43442
Accessibility
Permissions flaw allows apps to detect installed apps (fingerprinting)
Privacy Violation, User Tracking
CVE-2025-43455
Apple Account
Malicious apps can screenshot sensitive embedded UI (login views)
Credential, PII Exposure
CVE-2025-43398
Kernel
Memory mishandling leads to system termination or kernel corruption
Denial of Service, Potential Privilege Escalation
Additionally, there are multiple high & medium vulnerabilities have been disclosed that enable sandbox escapes, data leaks, and web-based attacks with significant impact potential. Here are some cves in the below table
Vulnerability Name
CVE ID
Affected Component
Sandbox Escape via Assets
CVE-2025-43407
Assets
Sandbox Escape via CloudKit Symlink
CVE-2025-43448
CloudKit
Stolen Device Protection Bypass
CVE-2025-43422
Stolen Device Protection
Cross-Origin Data Exfiltration
CVE-2025-43480
WebKit
Keystroke Monitoring via WebKit
CVE-2025-43495
WebKit
Apple Neural Engine Kernel Corruption
CVE-2025-43447, CVE-2025-43462
Apple Neural Engine
Canvas Cross-Origin Image Theft
CVE-2025-43392
WebKit Canvas
Contacts Data Leak in Logs
CVE-2025-43426
Contacts
Lock Screen Content Leak
CVE-2025-43350
Control Center
Address Bar Spoofing
CVE-2025-43493
Safari
UI Spoofing in Safari
CVE-2025-43503
Safari
Recommendations:
Update all eligible devices immediately (Settings > General > Software Update products) to the following fixed versions as soon as possible and check the updated version from the Apple security website.
Patches are available and should be applied immediately.
For environments where immediate patching is not immediately feasible, you can also follow the recommendations below.
Enable Stolen Device Protection and Lockdown Mode (where applicable)
Restrict app installations to trusted sources.
Avoid visiting untrusted websites from browser
Use VPN and enable Advanced Data Protection for iCloud
Monitor for anomalous app behavior or battery drain
Conclusion: The iOS/iPadOS 26.1 update fixes several security vulnerabilities that could affect user privacy, device stability, and system protection.
Organizations and Individual using Apple devices must prioritize deployment of this update to mitigate risks of data exfiltration, spyware and other attack vectors. Timely patching remains the most effective control against zero-day exploitation on new vulnerabilities in digital ecosystems.
Overview : Brash Vulnerability works on Google Chrome and all web browsers that run on Chromium.
A newly disclosed vulnerability, Brash, exposed a critical architectural flaw in Chromium’s Blink rendering engine. Blink is Chromium’s open-source rendering engine responsible for parsing HTML, CSS, and JavaScript, building the DOM and render trees, and executing script-driven updates to the browser interface.
It underpins the user experience of all Chromium-based browsers and is a core component of their performance and stability.
The issue allows a malicious web page to crash Chromium-based browsers within seconds, including Chrome, Microsoft Edge, Brave, Opera etc. The attack works by overloading Blink’s main UI thread using a flood of unthrottled DOM operations. A public proof-of-concept (PoC) exploit is available and can be tested on machines, that escalating the urgency for patching across all Chromium-based platforms.
Technical Details
Blink lacks any rate limiting or coalescing on rapid document. title updates, allowing an attacker to flood the browser with millions of DOM mutations per second.
This saturates the browser’s main UI thread, causing extreme CPU usage and blocking event processing, which leads to the browser tab freezing or crashing within 15 to 60 seconds. The exploit can also be use to trigger after a delay or at a precise scheduled time, turning it into a highly controllable logic bomb.
The exploit requires no special permissions beyond navigating to a malicious page, presenting a severe and immediate operational risk until patches are deployed.
Attack Flow
Recommendations
You can follow the recommendations below
Avoid clicking on suspicious or untrusted links, especially those prompting unexpected redirects or downloads.
Keep all Chromium-based browsers (Chrome, Edge, Brave etc.) updated with the latest security patches as vendors release fixes.
Enforce automatic browser updates within organizations to ensure all users receive critical patches promptly.
Monitor computer endpoints for unusual CPU spikes related to browser processes, which can indicate ongoing exploitation attempts.
Educate users and employees about the risk of drive-by attacks through malicious websites and the importance of security awareness.
Conclusion: The Brash vulnerability reveals how a simple architectural oversight. It lets attackers crash browsers by flooding them with too many title updates too fast, causing the browser to freeze or crash. This attack can be scheduled to happen later, making it harder to detect.
Mozilla Firefox and Apple Safari are immune to the attack, as are all third-party browsers on iOS, given that they are all based on WebKit.
The best defense is to keep browsers updated, avoid suspicious links and stay alert for unusual computer slowdowns.
Docker Compose Path Traversal VulnerabilityEnables Arbitrary File Write and System Compromise
Summary:
OEM
Docker
Severity
High
CVSS Score
8.9
CVEs
CVE-2025-62725
Date of Announcement
2025-10-28
Actively Exploited
No
Exploited in Wild
No
Advisory Version
1.0
Overview
A high-severity path traversal vulnerability was identified in Docker Compose, a widely-used tool for defining and managing multi-container Docker applications.
This flaw occurs in the handling of remote OCI-based Compose artifacts, allowing an attacker to craft malicious artifact annotations that bypass directory restrictions. As a result, malicious files can be written outside the intended cache directory on the host system.
This vulnerability can be triggered even by seemingly harmless commands such as docker compose ps or docker compose config that resolve remote artifacts. Organizations should upgrade immediately to avoid possible system compromise.
Vulnerability Name
CVE ID
Product Affected
Severity
CVSS Score
Path Traversal in OCI Artifacts Allowing Arbitrary File Write
CVE-2025-62725
Docker Compose CLI
High
8.9
Technical Summary
Docker Compose added support for fetching Compose files as OCI artifacts from remote registries. These artifacts contain layers with annotations indicating file paths for writing.
The vulnerability exists because Docker Compose did not sanitize or validate these path annotations prior to writing files, allowing path traversal sequences to escape the cache directory.
Attackers can exploit this by publishing malicious OCI artifacts with crafted annotations, leading to arbitrary file writes anywhere the Compose process has permissions, potentially overwriting sensitive files such as SSH authorized_keys, escalating privileges and compromising the host. The flaw affects Docker Compose versions prior to v2.40.2.
CVE ID
System Affected
Vulnerability Details
Impact
CVE-2025-62725
Docker Compose (Linux, Windows, macOS)
Path traversal via malicious remote OCI artifact annotations allowing arbitrary file write outside the Compose cache directory.
Arbitrary file write, potential system compromise, privilege escalation.
Remediation
Apply security patches immediately to mitigate risks from privilege escalation and container escape.
Update Docker-compose to v2.40.2 or the latest one.
Conclusion
Docker Compose vulnerability poses a serious risk of arbitrary file writes and system compromise through malicious OCI artifacts.
Due to the ease of exploitation when using remote Compose files, all users and organizations should upgrade to the patched Docker Compose version immediately, scrutinize remote artifact usage, and enhance their container security hygiene to mitigate this significant threat.
