Weekly Recap: Chrome 0-Day, Router Hijacks, and Supply Chain Attacks Dominate Security News
This week's security landscape was shaped by actively exploited zero-days in Chrome and MikroTik routers, a supply chain attack targeting e-commerce platforms, and novel evasion techniques.
This week's security news paints a busy picture for defenders, with multiple critical vulnerabilities being actively exploited in the wild. Google issued urgent updates for its Chrome browser to patch a zero-day flaw in its V8 JavaScript engine, while threat actors leveraged two zero-day vulnerabilities in MikroTik RouterOS to gain full control of devices. E-commerce platforms running Magento and Adobe Commerce also fell victim to an unpatched zero-day, dubbed StyleSmuggler, which allowed attackers to inject backdoors into online stores.
One of the most significant developments was Google's warning about an actively exploited zero-day vulnerability in Chrome, tracked as CVE-2026-85046. This high-severity type confusion bug in the V8 engine allowed remote attackers to execute arbitrary code within the browser's sandbox via a crafted HTML page. This marks the sixth actively exploited Chrome zero-day this year, underscoring the persistent threat to web browsers.
Simultaneously, the CERT Polska Team reported that attackers are actively exploiting a chain of two zero-day flaws in MikroTik RouterOS, codenamed MikroTrick. These vulnerabilities, CVE-2026-67276 and CVE-2026-86060, can be combined to bypass authentication and elevate privileges, potentially leading to complete device compromise. Attacks observed in the wild have included the creation of unauthorized administrative accounts, originating from specific IP addresses.
E-commerce businesses faced a new threat with the exploitation of an unpatched Magento and Adobe Commerce zero-day, StyleSmuggler. This vulnerability allows unauthenticated attackers to achieve remote code execution, enabling them to inject backdoors into online stores. The malware, a Rust program, connects to a command-and-control server and awaits further instructions, with variants observed dropping PHP web shells into product image caches.
Beyond these critical exploits, the week also saw N-able releasing hotfixes for severe vulnerabilities in its N-central platform, including a maximum-severity flaw (CVE-2026-86218) that could allow for pre-authenticated remote code execution. While N-able had no confirmation of exploitation, Huntress reported observing signs of attackers leveraging related flaws after a customer's system was compromised.
Attackers are also employing novel techniques to bypass security measures. One method involves embedding QR codes as plain text within emails, allowing them to be rendered and scanned even when image blocking is enabled, potentially delivering malicious content. This highlights the evolving tactics used to circumvent traditional email security defenses.
Furthermore, the RevStealer information-stealer was observed spreading via malicious downloads disguised as game cheats for popular titles or as a fake desktop application for Anthropic's Claude AI. This malware is designed to steal credentials, target gaming platforms for resale, and can receive additional malicious payloads via command-and-control servers.
These diverse threats, ranging from browser zero-days and router exploits to supply chain attacks and sophisticated malware distribution, emphasize the need for continuous vigilance, prompt patching, and layered security strategies across all sectors.