Notifications
Clear all
Topic starter
02/08/2026 12:16 pm
TL;DR: A high-severity Chrome zero-day, CVE-2025-13223, is being actively exploited through malicious websites to trigger heap corruption and execute arbitrary code after a crafted page loads, with Google shipping fixed builds for affected versions, according to Anomali. Browser patching now sits on the identity and access boundary, because session capture and drive-by execution can bypass user judgment faster than most control loops can react.
NHIMG editorial — based on content published by Anomali: Anomali Cyber Watch on the Chrome zero-day, phishing kit, DigitStealer, BadAudio, and related threats
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes , and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: How should security teams respond to browser zero-day exploitation in identity-heavy environments?
A: Treat browser exploitation as both an endpoint and identity event.
Q: Why do browser security decisions matter for IAM teams?
A: Because the browser is where users enter credentials, approve OAuth grants, and reuse sessions, so it has become an identity control surface.
Q: What breaks when browser patching is treated separately from identity monitoring?
A: The response window stretches.
Practitioner guidance
- Enforce browser update compliance Verify that Chrome auto-update is enabled on every managed device and check for version drift against the fixed builds named in the advisory.
- Correlate browser compromise with identity telemetry Join endpoint detections with session creation logs, token use, and device posture events so a suspicious browser exploit can be evaluated as an identity event, not just malware execution.
- Review high-value browser workloads Map which users and service operators rely on browser-based access for privileged actions, then tighten session lifetime, reauthentication, and conditional access checks for those flows.
What's in the full analysis
Anomali's full post covers the operational detail this analysis intentionally leaves for the source:
- MITRE ATT&CK mapping for each campaign, including the browser exploit, phishing kit, malware, and ransomware items in the roundup.
- Vendor and analyst commentary on why defenders should expect more browser exploitation and token theft activity.
- Short-form technical descriptions of the other threats mentioned in the roundup, including Sneaky 2FA, DigitStealer, and BadAudio.
- Direct comparison of the incident set across drive-by compromise, phishing, infostealer, and espionage patterns.
👉 Read Anomali's Cyber Watch roundup on Chrome zero-day exploitation and related threats →
Chrome zero-days and session theft: are your controls keeping up?
Explore further
02/08/2026 1:18 pm
Browser compromise is now an identity issue, not just an endpoint issue. The article shows how a drive-by browser exploit can become the first step in session theft, token abuse, or downstream credential capture. Once access is mediated through the browser, IAM teams have to watch for the post-exploit identity artefacts rather than only the exploit itself. The practitioner conclusion is simple: browser compromise belongs in identity risk review.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to the State of Secrets in AppSec.
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases.
A question worth separating out:
Q: How can organisations reduce the impact of drive-by browser exploitation?
A: Reduce the value of a compromised browser by tightening session controls, enforcing conditional access, and revoking tokens quickly when compromise is suspected. Combine those measures with aggressive update enforcement and device segmentation for users who access sensitive systems through the browser.
👉 Read our full editorial: Chrome zero-day exploitation shows browser identity risk is widening
